Re: [PATCH bpf-next 2/3] bpf, sockmap: Restrict iter-context sockmap updates to iter/sockmap

[Jakub Sitnicki]

On Fri, Oct 16, 2026 at 11:09 PM +02, Michal Luczaj wrote:
> @@ -10341,7 +10342,12 @@ static bool may_update_sockmap(struct 
> bpf_verifier_env *env, int func_id)
>        */
>       switch (type) {
>       case BPF_PROG_TYPE_TRACING:
> -             if (eatype == BPF_TRACE_ITER)
> +             /* iter/sockmap only; type check rejects a freplace of any
> +              * iterator's bpf_iter_sockmap() subprog.
> +              */
> +             if (eatype == BPF_TRACE_ITER &&
> +                 env->prog->type == BPF_PROG_TYPE_TRACING &&
> +                 !strcmp(afname + strlen(BPF_ITER_FUNC_PREFIX), "sockmap"))
>                       return true;
>               break;
>       case BPF_PROG_TYPE_SOCK_OPS:

Explicit bailout when prog->type == BPF_PROG_TYPE_EXT might be more
self-explanatory.