From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.215.181 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560868; b=4D0EnNO5dhaFFkWJNBthInrt8fU7YD6dKvP2gzuaGiYMpDOoWQm0bbfQRX1iULluiqLX 12CcZODp4mxpbn5ESPRdMIeHBWTj1hZbVcpLmRFA3cd9qf2wFpaG4EXv0GOFAjq9u0Vjc 8p2eLoDtUuPpJFYxrlxAukhx6t3wzTXVMHHKW/yKwdusmQd49BOlfQ8ymExjJKRvJ2/SY yoclNVNWeHtgXgnaZpZ1X/gUchAtjXGWv5oJpOdmjoy0hN4gpoevveKuMLWY6OVsg3xTG SYtKGhtkIcvE9AftEZV/AZBl0iVVgH0z48ooBZs8ThIQsKgIhsRBhs9niw2aNpCuPng== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560868; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=DFLLbX6mAbQ0jCV7LiEZmOooBbXiKj6J/ISxTH/9yE0=; b=bE4XyXXE0ELLTCoO3hLFbrIU6OWhV8wbsCB27mpvMBNLfEFSkDmBsCnvGbNLbG3IenAA zB58Ozec5huIbw2Bk9rG4uRyyuGmz0Z/iO86F8TBnVxmVR9w/ILUUZhKVPMQlgj6efAAD SU0ytWfwvy7gZbhHkQMYCHKZf0RAHgaBOZ7zR1kvEkt/RFj9R5/7dA7BeWsojxtfJ2Ef5 oqK6IIDxWe/LxknojFhv5ND0m2Dzrse1VSn1TZ4sd2G6jw2kIu9fhJz4PxYr5P/Q6+YXg 8DYUGXmS/qy54SWMimgI45Rc21kSWmNpFOa+i7S5fWJlCE7Jr27nf+Ev+IGJq6Pz8Vw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=sllsnT2d; arc=none smtp.remote-ip=209.85.215.181 Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C2FE9606A326 for ; Sun, 1 Nov 2026 19:21:07 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org C2FE9606A326 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=sllsnT2d Received: by mail-pg1-f181.google.com with SMTP id 41be03b00d2f7-cd8ba7c2694so657129a12.1 for ; Sun, 01 Nov 2026 11:21:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560867; x=1794165667; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DFLLbX6mAbQ0jCV7LiEZmOooBbXiKj6J/ISxTH/9yE0=; b=sllsnT2d1js8Ufshg7OE9+Mn2UoeFf8stp8zP0BYHTroYSLf2lj3sZVPgdMzVcxJb2 QY5g2cK1j7WV93dfzMUDBCNAz4ZqtFKBvnwM123VDmo4XZOjbRQxEwMLzoOfjKGNEXrV YCJM3an8dSrTgLeOt0A4NpyqlHTc7ZLS550qjaCrgIyWchSf7/EK4SjVy8D3KTyUuLeh dQhp0f2NsXTkALt2wMm8tDJUmB2HXk4I1MDnf6u1GSWNsrqAGwYDLQrQ0lc2OFVVFed/ s6gLxRtAj/HSwxsep62r5gI30r2ZA+l8o2Z04kyKwOZ+I9gVVIC4TeTuVmVa1jjYzafE bIoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560867; x=1794165667; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DFLLbX6mAbQ0jCV7LiEZmOooBbXiKj6J/ISxTH/9yE0=; b=PS81IISVRB4couChm8Ms7yE3otjeKeTGWpG+MGc232Y+aJ25clatzIM6+5QTBK4M6i dlvHjW3IoK+Xb2cHfh7FNWJJh/gzU1ozvhbNh7UrOp6Cd56DYEQkAXoQpIYD/g/oLRAb TBYYllB786rOJIgjDlQcNcdLJHXZ7pVOpTJJKyYL122lQ+BlqTofrfQniRTRxFh+lhku 8xHa2eYJykdhTKOZB43xygLnX/kUFRYdmhU0qOhAnH034V+OACB1QLCxYRpqJjvFe+wc kH+2CujnXQQPm+9RB6NGcylP4NlPyfIuKDwS4Fa7GII6Gqf1pfxNgKaWYAJOfjijnfR+ e5bw== X-Forwarded-Encrypted: i=1; AKwUvByJ8xa2g8sPCLogDHwAazjQ72yZ+oVUzWq4WORS5aTV+w27ygUH+DB2YjD5Gv5hTi0YIYA+8w==@lists.linux.dev X-Gm-Message-State: APuU4Z9yPYxqLIoVJeHNrZNBNxkOpH+F+YdLlgVfuCTRfiRsPW+hiVUE h9E3Xt6ZHrqXz0Avy6koK8OqGAieR3qyVas8MWiKELqeZZvhRWi5SlKg X-Gm-Gg: AYBFou0aL5QyiuACEkTK0CRFGMI4o9zLREOZSrOxHhzixsigBViNXKYGmii8MdbQ5H6 sUDgsG6545b63cDu2jWlgU4UnpC/9+NWT5c9EbNOeIYzPYZJ7ZPx5BQ05KQt31fnb/gd35h7RWQ oeB2m/yR/0ZykH0DJk22CbGQZmSUXjHneo3B+EadRTS5uUtT75FNaa4i3J0jHchzAW5lGy4SqTH ezTvbErpLzwEx5qYsPk5TT7upB2NkdE9x2GJ39RPlxeRWKt08EwqByoxijx2ylNKhF0chr7TZ+n XLs8lu85qOo8qFLUTgeZyyBREWOA+EAMRxbkrgoJf2JHuSacdpHkG2GOrZsHc8YUUTSg9h2r9Si qM6Og0c6uPSg621VkwqvrrTYfgBT32XeeVfMLiIq9QjkvDx28aUN0h+qCKNRrlcbxBqxwVQxqv5 qraCzo/48XeQIxDAA56qMZ3hH0q8PScOkLvrybTjjCdNIyoelhmoifQqF5UJ8hgsh96PrDEab5e e3/dBQZfE8H+wjg30hhIQ4fLT3yRiJBJ0l32Z5mq4gM3Q53FzXH5BoMGSTYxcb2ggt9z8oMH5fz e54Donr3U9kVJJdflD7ViUnfNjgSvlhbl7eaQjkK+B8SxW6OxRS3/R99HNq7o3h5nOIT2TwngdY SpY7bh3CHts1BSBN+xjna+RK4Xi3sc7gIJbhePgDu7RRuPEkgs3HyJ98bdAIOJ1m9ZDN/e/EOhg == X-Received: by 2002:a17:90b:28c7:b0:3a0:a912:e759 with SMTP id 98e67ed59e1d1-3ae897ee62amr6770112a91.25.1793560866933; Sun, 01 Nov 2026 11:21:06 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.255]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae845984absm11157931a91.10.2026.11.01.11.21.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:21:06 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 01/15] bpf, sockmap: Write sg.start when recvmsg() faults Date: Sun, 1 Nov 2026 19:20:43 +0000 Message-ID: <20261101192057.2296489-2-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Josef Bacik __sk_msg_recvmsg() copies an sk_msg to the user buffer and starts at sg.start. After a full copy of an element it calls put_page(), unless an skb owns the page. It handles 0 copied bytes as a fault. It writes the new sg.start after the loop, but not when copy_page_to_iter() faults. element 0: length 0, put_page() 1: fault here 2: not copied sg.start ^ today ^ this patch Each subsequent call copies 0 bytes from element 0 and returns -EFAULT. The user cannot read the rest of the data. sk_msg_free() starts at sg.start too. It calls put_page() for element 0 again and can free a page in use. Write sg.start in the fault path too. The commit in the Fixes tag removed this write. Do not write it for MSG_PEEK, which changes no element. Fixes: c9c89dcd872e ("bpf, sockmap: Fix partial copy_page_to_iter so progre= ss can still be made") Signed-off-by: Josef Bacik Signed-off-by: Alexei Starovoitov --- net/core/skmsg.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index df385a5a961e..f03519468ad1 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -443,6 +443,9 @@ int __sk_msg_recvmsg(struct sock *sk, struct sk_psock *= psock, struct msghdr *msg if (copy) copy =3D copy_page_to_iter(page, sge->offset, copy, iter); if (!copy) { + /* The elements in front of i are used up */ + if (!peek) + msg_rx->sg.start =3D i; copied =3D copied ? copied : -EFAULT; goto out; } --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.42 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560874; b=0teAe2TrY92MXBVrtVM3Yj54hV29YTgO2iDdWwV98/Yte9dsXnJmCWK7mWaU4SmCSfHL bPOjim4wPu+gffIj3nuVSKRp/VfmFQI6/xq0LVzAzedOGcqywyVZwcR8jZ0OPxTSawztZ dRDpuyI5YBAHJGFkAruB0IEDIsGrReJjumdAC/2UYiNNqtreAxiWHxdv17KizvJ2dGm4h CdGEI028mdRk4j55p63qXhqNK0G9C3aKkBti0RDdkPOSTLhj67JiPrMOglAn847+heIsj czFx0nSf2vJsABLbJbzfAYKMpfTNhBODa96RIdAzy0aRsHKJ4QzzYZ5E5qx+PDJ9sOA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560874; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=sdirJ0jP7o+YHEJCnK7VR6r1ybPNKkJjwR4pGDyhi74=; b=yRx2SAloPloKukpYCnnSCuDsn10rvUTSoWsV31nq7VI+FeyeC1zKJwXgleP6tgv/pEdf HLMlojXgc2fDMpf9XAFXhLPCJj96dPE4oe2aa97geijMuhExR6aEiH61syLQH3AHwnWQF qCMIQ0zzwYMBhUniaqSIrKDFp71IoY4nMPZqHF3A4yitKkhgatH1soMwI1rQVmyCamQv3 bIDd+0d2z9qcT7HcbcpP/MNO0ghls1q2tx+qjzFl1nGIvE3k34H2D8yxdnCJ082hapNjC b2owaPgAwzqfj+AkhTK8XdPnEyfHaHmpu4CzqthK4ONeqoS9sSaw8tJ3pIoR0npyWLQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=yCdI0YAq; arc=none smtp.remote-ip=209.85.216.42 Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD330606A326 for ; Sun, 1 Nov 2026 19:21:13 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org CD330606A326 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=yCdI0YAq Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-3ac7c7b3a90so953560a91.3 for ; Sun, 01 Nov 2026 11:21:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560873; x=1794165673; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=sdirJ0jP7o+YHEJCnK7VR6r1ybPNKkJjwR4pGDyhi74=; b=yCdI0YAqaxOzabBOd3Dx88Kb59eSu0k+T769hOkADoOFj5iyIo1ASyT6gj712cLPgM chPktG1U/MjFTuXbGHjYukQwwqVZDUfslNmMp3Dc+YcmF+0xPyImn4jW0l/vJOirG6+3 7vZp22LgAzE8RBtdRRdxBF3l5FlsfPSeE0PdY7/zxQvnmSLcP65eLhppCXKKg1yn5Hud P2kg+6OURMjCd5u6QJeX4fBd19E5oWUrfiPi7Ycq2CRjPHCQly1A58Co4k1ThO9RcyEl rhLzcNn1T8VnwC92UzRC2DVgdI77pkHRYjhcNQlVNax/sunLksWc2PafdOXr8dEuZrXV ainA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560873; x=1794165673; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=sdirJ0jP7o+YHEJCnK7VR6r1ybPNKkJjwR4pGDyhi74=; b=WFjAoVUNKeEyFvUKJFG++GLxWBn5iRS1FW59L2y7Rl045EeSV37C5hJ00tD4pxAza6 Em8HsgHc8ilWdki7pFcvs+/xs/vwBIHXHYkivUEGRVLmtiHu1LhwBp3wnW7Fyi4kPE7X 6cG2tEVgPRF7P2Kf6c2Akz6p8IuQCvRYPThZTO3iCTXBoyneza0K6uZTFQXgyfaJiuBz IPWIlHb2utSljGT45/PKnK8StYJRVAqJRdL/7zrJTUpDUWx5FQ6t3Y3zJXcQVAUvRHW7 8lOeOuisLWXRFuO2VDiG6l9DDDzN73rfgItSrfwtEpwThs5po1AXo2j7pP9Kko5dnI6d 7/SQ== X-Forwarded-Encrypted: i=1; AKwUvBxTT0ajyiyQr38gqZWIbEy6xgVcViIJeWxyK8hhObLlkgARNoClGKbsgaPMitdA7wP3gcAg4w==@lists.linux.dev X-Gm-Message-State: APuU4Z84ne5vZP85FWWQFLC5EeSppwFr29vpr+ZmNea1GkbbZl1I4hPF tDna3oC6pXB91YR0cBSlLqUPfkPHVMKmAGAPcN2jQcQhr6OsQfu9h33K X-Gm-Gg: AYBFou2qd9u0fp7KECfZWD042vJV4j9HJdbUzIKoNNAGCpapfB3hAmTi3egWZPUTFQl gKDXxbNceR+RDWJkCredJg3BaEJVoSOFLYUZUTB11sUAeRg7mxWZwDV0NxiPZtxXD5OtgSu6LHR DcpvvVFPcbX/FQ24tTV93motHP948KTjwSOGsJiD7RXDJ0AdkBP+c6uDrSK/7cv13kQYtWbsKrX 0zkRrdizATDMle6NXcSttjhNlqnXpITIzIPoyyIUcGMJ7REn5XFPnn3mhPMXsvw38jCaHx/eAy4 OpF5qQ8DQ5ZgUiu57J6q8HTfqKS0D2C7ew/GU84+arnRFdhzBckR0/FeIkm09bEhLMX7HMXKEA8 yTtqcSosxFz+vXY4d9S+7H8NfTiMIhyDs3EUEqZDQSPXCJ0ghXJI7NNXdQYeMUCWDGPV9BfCrkQ JAc8dQCmcm7TFiMxGEyiRPz5Wg6JrjY0kW402Kb0G88mWqnY9kHqwiSgFRI+APBcs/5Xm4nGZXI aXqKKSe1zxOXhUx6jakmTTDjeSSzHIJg4ENAqSTNDV31oDaQwf+OVWqV9wKkvW8S+an8Z4L+6ZA ZOQrH7ZO8n0XB0wpo3IsIvNlGMwDKJMLUABmUmf6zK0Qgq+sNyJZwZU0kH8Orbo10MKw4vXH0R2 XGS/fWcCS0X47rATLVeypaDn/jLZfsJhreCZ3g6lrOKSOuyICy9Il581/0CnROD4Q597pYURHKa Lxiap5Z3i5RGP3GcpcXrU= X-Received: by 2002:a17:90b:164f:b0:3ac:9ed8:f310 with SMTP id 98e67ed59e1d1-3ae8984da7fmr7182937a91.49.1793560873116; Sun, 01 Nov 2026 11:21:13 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.249]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae87f69605sm6059562a91.2.2026.11.01.11.21.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:21:12 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 02/15] bpf, sockmap: Don't let an SK_DROP verdict stick Date: Sun, 1 Nov 2026 19:20:44 +0000 Message-ID: <20261101192057.2296489-3-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Josef Bacik The verdict of an sk_msg prog is valid for one message, or for the bytes that bpf_msg_apply_bytes() requests. These bytes can come from many sendmsg() calls. Thus tcp_bpf_send_verdict() keeps the verdict in psock->eval and runs the prog only when psock->eval is __SK_NONE. The code that resets psock->eval is after the switch statement, but the __SK_DROP branch returns before that code. Then sendmsg() drops all subsequent messages with -EACCES and does not run the prog. Reset psock->eval when apply_bytes is 0, as the __SK_REDIRECT branch does. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Signed-off-by: Josef Bacik Signed-off-by: Alexei Starovoitov --- net/ipv4/tcp_bpf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 8cf63a9e7fed..d90bcc911b36 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -509,6 +509,9 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct= sk_psock *psock, default: sk_msg_free(sk, msg); sk_msg_apply_bytes(psock, tosend); + /* The verdict holds for apply_bytes, not for ever */ + if (!psock->apply_bytes) + psock->eval =3D __SK_NONE; *copied -=3D (tosend + delta); return -EACCES; } --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.210.173 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560880; b=ltb994k9ob50iWJQr+GF2El/XVK1/lz2cd5cyZEPWxPF+evlMUWkvm4WvZO6QHNc0aOy WTLTP31fsnIo7Soiowzk4E/noKgadWOCpBu1/hbltFYcBbvWPThbPcAlYIoOhiXQZWQZz uM0xoiCSZXzMUhk757srvqdoMjDBFU22ibkw1d5+Q1lyS2llwmwBjIc3N8Wr159B2nd2K i1/t/C0fCqTW0iHzvC2HXqfNqbAnum0b1u41RKL2JRxt7ng5DtbwXhfefrs4yH2+BQiuv SplAGjwFDy6mNEcdL/Uw+27Iu+l0x8oCf8VW53dIDK8oOzrsdvNXBGZqjVmiWl9W9Ew== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560880; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=SU04LGyxjuYA40ODCW0YIdLfmYd9WdxC4UJ8kuxQrGc=; b=t1+RzKh5KUaEsfpTJBf4Ca5SUGiGjC6gluHyqNNgLwkCA4h7JbvrwId0gbhGdEXirhbO kKqMMyQpQk5qutaNiqY4Hk/X3FsPYWiWZUODP6eVzGpDX8LRaXblubdToeofns3KNbNLz MlRv9hLwglE3FhhxCZjPTXMX7llI5BygaXAVDooZ1bgwfMdIhOf+uEqr+LSCR4mqRgMUZ MsA8pX6EDY7eEDgM+WN/ercHobMnqYnHLfUFk9pQuq0q8MM6t/+0x43gZzcQchXM9yv9Q cD7s1DJvctok9JsgYOTdElms6NjzknwdLFAWTtIHZa19AEVyo+C8LUUEBjHEzrThPgQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=0JFVIW0R; arc=none smtp.remote-ip=209.85.210.173 Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E17D9606A330 for ; Sun, 1 Nov 2026 19:21:19 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org E17D9606A330 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=0JFVIW0R Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-8a594d313a3so1307864b3a.1 for ; Sun, 01 Nov 2026 11:21:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560879; x=1794165679; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=SU04LGyxjuYA40ODCW0YIdLfmYd9WdxC4UJ8kuxQrGc=; b=0JFVIW0Rq06scmyC1KhsuUYlCPMdwCSuJW8EihqeBE+2c/+NJgxmuhJ8QkZNEE0cOp OYxP19MFoHnr+2cl2nDxkH8oIPb88kNbxbnwxpUIFyoirVWIQiAcUHuDvImhjBbzAP/R nMaoKCAhTvAGCpWfE2cNAS3F+iAQh75NMYJ71V28iElB89W0ym6LmpZIXxns2fpTdHkL r6QRR+U7CkdH9zSaaa9v9lPRjw6rlU5dtCmhuensYyS9FlB0++I9RwJyJPUIxm8OBsas Zf60XmTowh4Ko4ZrRcpHVhdZSOzmfI9ypL34BBqJPuEmXCJwokvAjTdPsCbdi+Eb3duY Y4mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560879; x=1794165679; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=SU04LGyxjuYA40ODCW0YIdLfmYd9WdxC4UJ8kuxQrGc=; b=NX/rfWxT5ANYXAyBocnZYIG6isuo19uxVQ2vZaJtsd2NpVJ0ILcw5USHIQdNgfVUPi QzEETdEMcqfaYlS5G0iXeiYKodbtAzIOFgk7+laxr3N+pTzdBSjnjOoH48If7ohB8+Zb 8saGKrVPgZp36EQquRQSEPoKuPDPqnJVxIcLmfvsvGI+6q2O/H2B10iMs3onHWuVhzyh NQ5Q7/tkVgnjkZffgTnTWB8hmTeVLpcpTQYid+6b/LWm0y4hGGZzZ/zcP+BlAwrvG+Gx 8QMt8tONMS7qA4VjloWlggkAnM/9e86mBpyMQGzQzBxdgg0VOe9NmDZHZt9h8l4TQcvI vEBA== X-Forwarded-Encrypted: i=1; AKwUvByW5mkVawN+XkcibZO1aa+FgJHfkBFNBxd36B9A29CpwkpyQlnE/somZ++vg8PZxH4kBX6mfA==@lists.linux.dev X-Gm-Message-State: AFq9FYKIfXEYXWRjxdgTabB2sCZOdtuRX2v/AtkiIjsvgjVReYkbTn74 4vHTns66rIP69iCfDpZun2RrFI/btkGRyWwNV4cdamBziZjBMqkmYgRj X-Gm-Gg: AYBFou0taVrOXArXlLi5zTEDh6Ft9k9TchqKULH8J7hOrFJWFQK2ZdnHb/+G4qMiFVm AT+zXnBKUURB4cLVX3Xc6ZRwvFZurRA2zXo/khCqYZnpxpD0jl74j2Oi2VVadbu1+Y1GoNLYVUZ wMaxciFUUCbnRiRn1/oo8vtRh45LHkO8U4/GeTSA7Srltm3d9GAg4UY9wwhCodm9TFQ76CkcgBa 2G7ruZ1d90fwQC9GCGVTNbFxYFGfm5C5Kd8kEWDic+aHFnuVtmeWTbw0hKRiTt/gMLmLBx6AfVg 2lMqcd7aVnj7w6YwLf6HilZmQxMcksVZO44Iqs7x8FdDnSevjsmmVjPSKa7/yOKAwSY9TnD6eeC zc3PH7m1sGBtcsAW2nsLynquL/vuSekMeErke/IVKbQms57KAGr0So8i7fI4ii7DFYGMPwPxdBH CiS/+gt4QqUuUEItR5cwGXF/o35KIxpEvp1nFfIYA9za1wh0DWbJkUn35n+LhCrXft44vBLbRMb LqlC/I06Z4MSu1RSWgF8EDlfwmsLBn3kHQY/tmXMX+Lv1LgoTdxyjINjpT2LlQH+hbNnPqHtaKZ qXU2FlcLeALblZ0Hbqse6tgujY1ci6SEqS2admKQ9Dyh1OGQGyHv8WeSES6zKI2G6c78zI0oH3p Iky49Japd2o82LSBMGFuv2YhiHt0vdqsk7f1MOuwGO4OGlMZiiJhNE17c4X9ez3UreynI5N0sP5 8= X-Received: by 2002:a05:6a21:1bc1:b0:3e2:1a3e:395c with SMTP id adf61e73a8af0-3e928a51d5dmr7646160637.59.1793560879239; Sun, 01 Nov 2026 11:21:19 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.255]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8aad963d055sm1140810b3a.14.2026.11.01.11.21.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:21:18 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 03/15] bpf, sockmap: Don't let an SK_PASS verdict cover the next message Date: Sun, 1 Nov 2026 19:20:45 +0000 Message-ID: <20261101192057.2296489-4-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov tcp_bpf_send_verdict() keeps the verdict of the sk_msg prog in psock->eval and runs the prog only when eval is __SK_NONE. For __SK_PASS it resets eval only after tcp_bpf_push() returns 0. But the push can release the socket lock in sk_stream_wait_memory(), and it can fail. Then another tcp_bpf_sendmsg() sends its message and does not run the prog. With bpf_msg_apply_bytes() the verdict covers apply_bytes bytes. After a failed push, apply_bytes still includes the sent bytes. Thus the verdict covers more bytes than the prog requested. Reset eval before the push when apply_bytes is 0. If this push fails, the prog now runs for the rest of the message. The same already occurs when a message does not fit into one sk_msg. When the push fails, subtract the sent bytes from apply_bytes. When apply_bytes is not 0, eval stays __SK_PASS during the push, and the prog does not run for another message, as today. The verdict must still cover the bytes that a failed push does not send. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Signed-off-by: Alexei Starovoitov --- net/ipv4/tcp_bpf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index d90bcc911b36..072ffd8347a6 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -457,8 +457,14 @@ static int tcp_bpf_send_verdict(struct sock *sk, struc= t sk_psock *psock, =20 switch (psock->eval) { case __SK_PASS: + /* The push may sleep without the socket lock, and it may fail */ + if (!psock->apply_bytes) + psock->eval =3D __SK_NONE; + origsize =3D msg->sg.size; ret =3D tcp_bpf_push(sk, msg, tosend, flags, true); if (unlikely(ret)) { + /* A part of it may have gone out */ + sk_msg_apply_bytes(psock, origsize - msg->sg.size); *copied -=3D sk_msg_free(sk, msg); break; } --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.49 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560887; b=mE3EH5vCj7NGKWrb4MNwnWgVmQIS5PZgAsxuLOUwUPgCtcIQLO3ueLVKIHlDZ+7YvxNC dGCKqGoxOEYUgVDcz55+GAJ/cnBUnSNcrCiaVXOTQx+XJgORtKQ0iwYvlD0oDHOaj7ADS 3BmayTHyD1kKXYN6g6DeoU30sszbIdI3gQn9deDzXXUofbW75GUCNJlTDgE4GvSnSNPmM PPPIEzg67/ecKQgAoe1Xw1vUi6BaITzzfv6IwAhLr84SLJNKm1d+mW/6EjlOwLeA8gwvY vty63lxVMSSfrzEejcJGTJA9CzrJtPE4n+meSe6msgq4HCEpIk/KmHw2pJC0K1EsNzQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560887; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=lvky38gqrvpjSBWUSg+Q6mjoyF0URntzlHpSfOxGZkw=; b=U/gb87P9iUMNfc9M7etEysAioEWtOeFYgJ+jk94jMpKZsrvqtZXzxiCROslx0CN2s6Fs PhjxE5sMYsjd64dswdR4Tq0aaHUSTGSgGNDdWprjhUcxoqU2tLKPDMhxrmizl5HELelys /bk8ax/FWo9/voOHe+YT06l4FAYXyzqsLHHntPGC/EsDMGPQ/4/Gg9s+wPQWJ55DlaxOj bne6KabLAg2Tci+TuQMPQey8105e2Y/QMm/4muhrqi8C7Hoo+MqoDkmE/jGJgUQcpL/lr 7T1gXGz/Ts2OhCWxC4JwOWwuj1+Nn0vRb3wo3s6fXdb9qBES+mgeol5rCPfxn563uww== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=uTStMIHc; arc=none smtp.remote-ip=209.85.216.49 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0F23B606A327 for ; Sun, 1 Nov 2026 19:21:25 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 0F23B606A327 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=uTStMIHc Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-3adf5f6833cso1206578a91.0 for ; Sun, 01 Nov 2026 11:21:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560885; x=1794165685; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=lvky38gqrvpjSBWUSg+Q6mjoyF0URntzlHpSfOxGZkw=; b=uTStMIHcS0vVYgJxy7Bq58zu9MWhiZk3MZnyclhvOWz04sz00iZaeVqKqVLE9Gntm7 +sks9F9/0RLYGajZq3AfpyxJu08acEjQx+3HxXHSu+PatBGVBuVnYlIlevDmFqLhKsM0 7JEu30FbPps/pdzk8qjrxdzPoMK3twa1xBmGmm5xGswKHAi1g2Tmfo9foBguMnA0mvvA DNCVPE036+ibbL64Zx0ef2wf81lhuLtvPX5A6tQ7H+c7OIFbZwMVuBA08pwvH9puS4GI Gg4tsKqBJKWkdG1iEUlukoz4nIKSOAP16dLhd3fJA1ybtr4E/iFEWBwrwugujmam9gcH zI9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560885; x=1794165685; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=lvky38gqrvpjSBWUSg+Q6mjoyF0URntzlHpSfOxGZkw=; b=wfUAT9AhNCfAXWW1IutRYYsZeKyA140UqRm8ids3Bg2simcuW800A/wQnu/GhKtJWK uCF39nE5QgQqpG/+PmEwhEdHUiQAIM5W5/2oAAEvdUGApboeBnLs259gBvn8UkAco2ST 73DtttlLlhlbanps6f9vQDP/Wg5iNcV/IgDEs/Z2S4cniKFUcZ8JcrI5VYpPHq7Ws+TH QOFOR2FbAhwpo6Q5tUQfL5NzwxKU8mLszYLLjwzksS+wyowa75nS9wUzq16W3XeY6Odt YPmB7t0jzksoHT9DEdDC8Yw4atPI5QFWq9hRzza60HiO6PHWzODmSayTTubVdVaaT3hY 3mnA== X-Forwarded-Encrypted: i=1; AKwUvBxa/XVCN9S9OlZ2FDPdwgSUPbBqzwUFetlrWBs5QI5GBJhc+mmUpFr1rjhJ5qnk05PpurVmYg==@lists.linux.dev X-Gm-Message-State: APuU4Z+fbCc/V7scU5/4Zprlkfr0MAsIPU140Ku8Ybe5o+Qm8xVmXxP8 ZkVJo+fNBTthbtCWhbCeD5T11rbpHwnd67sgWTAPhriGtphIk2iUYOr7 X-Gm-Gg: AYBFou1hAXojEYvMLg+MxRYRV1/T3E/v1JTc/wu/NX0HtX3F5xedHMI5HKOATN1Panv NWbDCFsOyICcEVK6248IyHT6a1lAME9L7z+Ry3suVEM0vkzmmgylx5SI4oOrJXuV2s8u0vctXbK 1KCUrEV5s1ng4iy9JZqFG2lqMw8FqfSR1T02scdQSVwslJ9QkS716hitVq76CZF68UP279+xquy xZuJmwQ/9lek2xzoNt1H/MowMXV90GP7F6bd1ptOGdGqSrf+nJj4s8/zPPebdmE80FQVAuwu27V 7WYcP+YlJ7VNSv+HyoO/+6/4B5hOPi/TWxY1m3V23HGN/3SEaOjAh6Hc1nbqwc0Mf3syG1etQE8 zQ24f/VnAw5KfowaTdzC2vgmdt6pKGh0JbobXAEMuXX5K182YuW+py//nYbIex8MW57H47y6T3R 8mugDYs43aJQvLyF5ofPoYvw2W8pD0PV886y3yqEFIlsJ464DblR+Pov7FDVtswX0Xb7kkviS2G me3D8IAjgt0ZS0c1F4gDL1PfbuTSPKpF3djgHRqp30K0diTNHbxq/We3yr0eliFd5wn+BOyo9NG o6BEubCHKkiyURsuUxgSBltRURKZGZNtcqXZr0LpK/w07vM5KoZ+FypYuCPVH5zKh6/8ZxZoswk 4GlgLFJFZqlLi0/s/kMBYPNYjf3ZQ+GiwLW4KTHtlZLio2UXMF5dJCO7F4TPT1Qc8p8k7pW7jtw == X-Received: by 2002:a17:90a:ec8d:b0:3ac:b7b9:6484 with SMTP id 98e67ed59e1d1-3ae897ae130mr6233275a91.45.1793560885317; Sun, 01 Nov 2026 11:21:25 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.249]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae84596e3bsm11151183a91.9.2026.11.01.11.21.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:21:24 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 04/15] bpf, sockmap: Subtract all dropped bytes from the return value Date: Sun, 1 Nov 2026 19:20:46 +0000 Message-ID: <20261101192057.2296489-5-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov When an sk_msg prog returns SK_DROP, tcp_bpf_send_verdict() frees the full message. It then subtracts tosend bytes from *copied, the return value of sendmsg(). But tosend is the number of bytes that the verdict applies to. After bpf_msg_apply_bytes() tosend can be less than the message size. Then sendmsg() reports dropped bytes as sent. Subtract the number of bytes that sk_msg_free() frees. After an error the SK_PASS branch already does this. The SK_REDIRECT branch does the same if the message is not the cork. Nothing changes when tosend is equal to the message size. Otherwise sendmsg() now returns -EACCES if it sends nothing. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Signed-off-by: Alexei Starovoitov --- net/ipv4/tcp_bpf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 072ffd8347a6..b9761af13989 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -513,12 +513,12 @@ static int tcp_bpf_send_verdict(struct sock *sk, stru= ct sk_psock *psock, break; case __SK_DROP: default: - sk_msg_free(sk, msg); + /* All of it is thrown away, not only tosend bytes */ + *copied -=3D sk_msg_free(sk, msg) + delta; sk_msg_apply_bytes(psock, tosend); /* The verdict holds for apply_bytes, not for ever */ if (!psock->apply_bytes) psock->eval =3D __SK_NONE; - *copied -=3D (tosend + delta); return -EACCES; } =20 --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.177 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560892; b=i7vz5duTVDUQq1kmue+Qjj7v6hMK3WGyFQjE1jnEKIUmQNT2x/fze6eei+iSEjHFTa4V pAFs8KoeWYaXtHX9QeI4mzdvlDIJ3CqFuPM7ZAeMnE+6v8hcXxpnkP/Ggo9ITR63I4mmF 8F5KiWBwsYbBaDSiU+A5gnI6w7f8q1uXzfJ2yzI7UdtNzzldPUA+edK6WuXdRJARb/3gP o5X6HAPSMNyGFuME0vckd6uASOAy2GUEZd8kjAAv2I3z3gGmEqFtT1pElUAT1XDQxiPhX htF4j9ECQ2ps1YLxKvlbYZHGWA4OzE5Jq3xA/AUiKQqL+zuRUtKY8IPN8mB/bu3kY3w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560892; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=0ivwDO8RmSZboOluSZSZngxFUW4tZlFEXHx0gIyw2xc=; b=ACGf1HY3hF5Kcy0ZdTE967dKhzMAsJ+yzT2gnzwo/c8K4sz3yfzBpEe6LBWGiq6jKazL GblGEHqExOrrvMWQcRM+Kuu18qnJMZU/zQtvmtXy/TZYKhxfDeLR/2uY6b1dzObdvf5pK bPRnp93gZWl4JS7l13Kt12BZSGQna2+62Rx1NtG/zSKyeFa6aPaikES1+omngPcLYT4Vl 2keSmcaHsvaw9Tuj+BkdiUeGpxQyOiI4B5qQGU16Pyqh8rmoffK8aYcsQzy1cAThXBAdo Ao/EU+4To9fMrPweXkq+qyXEICl9b9bJZoX+fFNQEahA7w1ftfkPqeCPKrWyXJDr9bw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=ZgFcT+PJ; arc=none smtp.remote-ip=209.85.214.177 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 67F70606A327 for ; Sun, 1 Nov 2026 19:21:32 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 67F70606A327 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=ZgFcT+PJ Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2eac4877accso7439805ad.2 for ; Sun, 01 Nov 2026 11:21:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560892; x=1794165692; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0ivwDO8RmSZboOluSZSZngxFUW4tZlFEXHx0gIyw2xc=; b=ZgFcT+PJ+iTiGUiRI0fs4rBDaET/sd6TmqCRpgL9uRj4lGYr5KXg5NplfKjaGHzQLJ YVplyyJPdEHUFfeUJ19GegNRA3uC5pxEtvOQNmbdTHDEmT/ebGkXUYldY0ElPaoeBJRn sXNFoHZJJlEcY48YkyBqW34g3nYORqIHmcs0MAm1w6uv0UcDNdXRSPVdRka7f9smYKGx CHSQykL9k85JlNd0yWTehyBnF6rGi9+viaNemHMd82SCCGmPzr6GDE42NL7jeqlF8/kp nvWVRX6rNZQbUsQroFBwKjBJbM/bJSBRfX6gC0BZboVTrfnWUMYxc4VxWFASzIx5mGTF sLzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560892; x=1794165692; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0ivwDO8RmSZboOluSZSZngxFUW4tZlFEXHx0gIyw2xc=; b=YLv8fs2Z+5kOvzCyZNv04zX7UUOlW4jN45GDgq5096oPPAEjh63eDbl4RYt2wtVoEB 8v41J5zKCIdxK9f6xOUiiz9Z3XGUqacn+XmrElbqy4eaLEGAl/8Re8cDc0Ksfi+/cXat LwzLH5Qhv1wOFpCBuzuLwAh08XkxVP8dePSZYDXd8D9uBFURYnGntp4dzUPco0z/DJeU ALUH+RU24Ym2qXV/Ll1lUXapUvAC0645zeaYo2moZ1uP3CEnCcTEneYe53c1OVt/Kwdh OHEPSk3gpJ+O5L5IFLpdBE0dEb66hvZK406iq4VIBig59OmLQ9tEz3aMwBDoTOB+t1mm LOTQ== X-Forwarded-Encrypted: i=1; AKwUvBy7TNqU3QM5sq2FsOc92MnDV5Afaprsqb0TKZvEm9t7JZU5jK94dNVDhwa/zsuH8oYgvB6lJw==@lists.linux.dev X-Gm-Message-State: APuU4Z/1SzBVVlhWFi9t0zvV9tl5t+FKgBLr/ZUX6xfOpH6VmA8wqq7u T0vN48ZJMyRDkBc20jTuXNkLvWgNgUjItAOkrXe2ZuUPI5jx3zp7Ew5U X-Gm-Gg: AYBFou1BD3UjNN9wfoP3wMWnGo9jRpgC9NBWufjDxLHuDoJ3lxGUfCHZonVMhizkx3E iEYbOcwJ2KULa+Yp5eaK8NrLW8ZpovBn1ZQDO0Z7CwpKI3FrtHO9BIAmLR4ywMvQmRmWhWZa/MP 7BoSTKabgSvMm9lZSi6lzl6DzTno3rcxlyy2sPbaHQb5dInIFuU0NR1plC8WBsBpCm+kZYyVO2n +PPpjiZ5u/IbFXMOvpeWoi+p/A9YVfneDnenUfDESCNj6dSn8pd0yZMhrUaPYI+tixsPfDi/eNb 2uk44wDOSyRF5Aszg0IdNVRHkCgJg0csQqP811ZVi3ScC4Ut+HERFRtfu5JK956pRLaZcQDuLmU 6yu2VajJfKu81VH0LkbQGfJ3X7DtPS5hxthwoEy5Dqv+65ZBUbRlhxlXxA8t4HpGQ3hTW9dkJ9x zZziItFSBpnWxmaBOQtl/mHhjC7ULSBPygTevRhjw7nOvHa6oBl3b17gj2XvubE1M2SD5VRDvUs 2YsCzgfsN49e+SGnP5qL2fM1qbRIlSYxvBN/YDrPQOtPe6xKCm4fxRq3qYAd+wJqxTjFzZSNmUs Hn1p76Up5chnFFy6pQaVa15/VJ5J0ypd6UPZuJOFwDfn9Pz9EWqC2FgAHL2sImmwWpejwVosBt5 uM2CO7dy8klZ8SScgEpQao8Xo7JDffocbJ+oT2Tnx62wN2W13718KT1vFKbwvCHNHeXnn2mMYcV XoaNwvuDEM9/BY74mPWQDk X-Received: by 2002:a17:903:38cc:b0:2e6:5ef:abe9 with SMTP id d9443c01a7336-2eb364b6332mr64259095ad.37.1793560891567; Sun, 01 Nov 2026 11:21:31 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.250]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2eb39248621sm18975285ad.28.2026.11.01.11.21.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:21:31 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 05/15] bpf, sockmap: Clear the resume state of a stopped psock Date: Sun, 1 Nov 2026 19:20:47 +0000 Message-ID: <20261101192057.2296489-6-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Josef Bacik sk_psock_backlog() passes the skbs of psock->ingress_skb to the socket of the psock. When the socket has no room, the function saves the length and offset of the remaining data in psock->work_state. A later run continues at this offset and clears the state when the skb is complete. sk_psock_skb_state() saves and clears the state, but only while SK_PSOCK_TX_ENABLED is set. sk_psock_backlog() does not test this flag for each skb. If the socket closes during the loop, sk_psock_stop() clears the flag. The loop continues, but the state of the completed skb stays. The loop uses this state for all subsequent skbs and sends only part of their data. A closing socket may lose the end of a stream, but not the middle. The state belongs to the skb at the head of ingress_skb. Always clear the state when this skb is complete. A stopped psock still saves no new state. Fixes: 3b4f14b79428 ("bpf, sockmap: fix duplicated data transmission") Signed-off-by: Josef Bacik Signed-off-by: Alexei Starovoitov --- net/core/skmsg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index f03519468ad1..a5d498982848 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -664,7 +664,8 @@ static void sk_psock_skb_state(struct sk_psock *psock, int len, int off) { spin_lock_bh(&psock->ingress_lock); - if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) { + /* No new state once the psock is stopped, but never keep an old one */ + if (!len || sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) { state->len =3D len; state->off =3D off; } --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.172 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560898; b=IriDnhnBAn7SIMOqTx3yQ3tGAerIUG0xd7QvXw5Qi+X+eUYbhYBWUVSw3HKLGzRg9JNE rBp5wzUZu3QPx84oZBbf4n0JKQVIk2wpvz9JJhfUAByAzJm6Iy2sVSWzoRFy8DSTV06lm UN1rwHiEw48q3bNOabeoxcy0cs5IR74WOSiETXyH+xsE+B/da7TVEBTH6Q8akBGEACzJw MaDaCk4DqoW2Sk3+Q2f6oRWKdglvHr4P1WLuM34771OP9hiJSW3dm8QlLLO75KfF/wFgo 3Egonolpo6ZidzM2At+W+KM9TfXxR9iMayqcGntvZcEFurDhTgvDxT4B4iFtan8qUfQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560898; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=dz6pRM/Io22GYPHM6stLxgSNOJoApnHNm/0rCYVyXHY=; b=zPeEaUl1Ezz6hUW8mAxDDNzqC2MZighvR75eeg5kUabZmbmY7UKKwOXdtfmLHeTWCIf3 ofZawrdzLI8/pRqbmY+L1JgmWU++20kqPpHlQSnyZJxBoGMIizySOtRoBOY9uJbLyOo6q QITsVWxCI+rkRsDUJQQ+YkU8ApLkp+A5IDaOIfU8c38dAYCvFyDNMYgHnWkshtl9QgfWI nI9Vw+B74XB94eQWEzbjeFSZbTsWzpF+HLGHVim8ZhTNzP4w3emp69qBPcW5n4JSKA1FX H3u7z4lUSXVZr+ZF3LN8OCGm8/M92Iiu/a59dw5xKwrwYpqL4D6iBWm6trw1r9/cTmQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=tWyQ6Jc+; arc=none smtp.remote-ip=209.85.214.172 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E859606A327 for ; Sun, 1 Nov 2026 19:21:38 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 2E859606A327 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=tWyQ6Jc+ Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2eac4877accso7440025ad.2 for ; Sun, 01 Nov 2026 11:21:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560897; x=1794165697; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=dz6pRM/Io22GYPHM6stLxgSNOJoApnHNm/0rCYVyXHY=; b=tWyQ6Jc+VjHqYvgElhqJOF2WisGR7Un4kSaC8w6rN64FxW8EpXxlkpNzUqHkvttooD s9nLyf1L3N2Q8BEwSKstAIssWwXGiRZtlJPDPOlhIwS6si63BckUUCoIPXE2G0moTJml Eyc6Ragch/rmZuiE6cpTjZyTLWZmzXRMGT5EL5N9yX0gkbYw/w6Zqeov8kEkLLMdWle3 U9aEBeOWItNpTH9qTqVC0za+jQTnzh7QgOj5UVDPHzcUiTUg1a6e2OxevMeKzIzOIGr8 iRkKDk+zwQ9OPy8e7TftBljYC1mf3zVkt/VhW6CHxwdrVLSSDw2ELcOKap6ZB07GFAvc BGzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560897; x=1794165697; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=dz6pRM/Io22GYPHM6stLxgSNOJoApnHNm/0rCYVyXHY=; b=h3KnxV3cQi6lssRRuREaphpx+9+dGN2F5aek97yLXKnchoMdYat6f75FlNLrcq8eI6 kTkxwJ5hRrZtp/6Tzjv7USb2hgbS9MFNUdutVo7/QtVY6rKRxdYBDPFMQ+LZUesA+LQM +Qrl0RzUSFKnJKLX/Aq+I4qA9rUukjLS+ReO/mxnsjQTxQUvMYZbiNM2uuXrxo21etOz WNKuhw7NHQJww4Tb377WOsyszTubfQXNDE0W3pLsjpxzq98x7mBCS1bmxOI1Ud4hd++M FjyclwK0ZfWNYks73QyyD5nLaPdyAJd8P8946MKaKPYB6aELKvtmP1TqpfQgk8YkOJwK KM/A== X-Forwarded-Encrypted: i=1; AKwUvBw11IbJnCqt8v5/Xvk0MU5tWqZY0UUc7o0YrEj7O3v1z+b/XIFkiNFosb0HZEIg9Dt3nv/vPA==@lists.linux.dev X-Gm-Message-State: APuU4Z9O/uRTYaDz/wYF0meIv2rxzhM0pBaSBh76BgzoGDu6zfJQHwKf GgwBUJzaXpjbmIG9dTpBSZncHrFoqsa66qkb/aujllYhH5gzWpr1wllV X-Gm-Gg: AYBFou0NqPWPoDlFCl36TGX4kNIN+yDN5IwnzatM1XYtmEpcMHZf3EA3i1ILYzmvn5E mRcYNwD/+A8u+f8GMdBvajqBrpXHdiEMi8Q2jCUeI5EdXmBLS3PGHGK0BN4/puPMluac6Ai4wyw sqrmllTNPggg+HcvU5EatnYgaZ1W/QqAHCwJP5hQ8/JgKKOc/eb3DXzPRSKYsxUtwKtH9+b+a3a S3bS3lAf1vO2/prrmsq/FPOnLQ6ZTlQ/r9w+5Jme4k/4S3bRTe5/G81uRzD5c48UYAd7VtdbvHA JGvjO1IO5R5b8FALR3/LQayzieKwRlfHqrkVj/P2upbzAPXaOJeKaLqyT/1bN6f5P01faZbCNpU OoHeOIo5A51ZVx3wTbfebaj9k3Gv6qqKDicdze57/TwzEe4T/0R5yvRJyBTjh+2aDHWxvEtf9mI rNKOtco8PqIIWWRH5Elh0Sdn90WqAduO22njkPmC8AjsOYP01qoDX8rTNxGvjKL4xdQta8Nzpsx T4B1OJb7orpqBOWjobj/kYfshyQlnNGlKC9zIWBTcK6UF5c0esa6YxUZYw6WfJecQhWDCku4O+0 vRO+0Gts5VurL0FbACqFlvK/eObhb5ZFEcKXnlxtuxF3gghH780H050u7xTo3zCWRbNAm8wNXoB wQklH09N0zH77b9AbTc4NLKabJCACAsAGI0UTsy2kEyyo2X/GlsCcFmjB2mm3vaiq8akdop7VsB C1A7X4hnP616SQ8Y90thg= X-Received: by 2002:a17:90b:2549:b0:3ac:a7ee:678c with SMTP id 98e67ed59e1d1-3ae89536be7mr6671928a91.2.1793560897506; Sun, 01 Nov 2026 11:21:37 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.255]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae6e9426ffsm15650206a91.7.2026.11.01.11.21.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:21:37 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 06/15] bpf, sockmap: Give no progs to a TCP listener Date: Sun, 1 Nov 2026 19:20:48 +0000 Message-ID: <20261101192057.2296489-7-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Chris Mason A psock with a verdict prog replaces sk_data_ready and sk_write_space of its socket. It saves the old callbacks, and the new callbacks call them. sock_map_link() does this to a TCP listener too. Its new sk_data_ready cannot read and does not call the old one. Thus it does not wake accept(). sk_clone() copies the new callbacks to each child, but not the psock. tcp_bpf_clone() restores only sk_prot. Without a psock the child loses data or does not wake its reader. If it gets a psock, the psock saves the copies as the old callbacks. Then sk_psock_verdict_data_ready() calls itself until the stack overflows. sk_psock_write_space() calls itself too, without end. Give no progs to a TCP listener, as before the first commit below. A listener receives and sends no data. It stays in the map and keeps its own callbacks. Add this exception to map_sockmap.rst. A listener no longer gets -EBUSY from a second map with progs of the same kind. Since the second commit below, a socket keeps its psock when TCP unhashes it. sock_map_link() does not see the state that the socket gets later. Do not depend on TCP to keep such a socket out of TCP_LISTEN. Set both callbacks in tcp_bpf_clone() to the TCP defaults. Fixes: 0c48eefae712 ("sock_map: Lift socket state restriction for datagram = sockets") Fixes: b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap u= sage") Signed-off-by: Chris Mason Signed-off-by: Alexei Starovoitov --- Documentation/bpf/map_sockmap.rst | 4 +++- net/core/sock_map.c | 9 +++++++++ net/ipv4/tcp_bpf.c | 15 +++++++++++++-- 3 files changed, 25 insertions(+), 3 deletions(-) diff --git a/Documentation/bpf/map_sockmap.rst b/Documentation/bpf/map_sock= map.rst index 2d630686a00b..eb466b86df17 100644 --- a/Documentation/bpf/map_sockmap.rst +++ b/Documentation/bpf/map_sockmap.rst @@ -33,7 +33,9 @@ of ``__SK_DROP``, ``__SK_PASS``, or ``__SK_REDIRECT``. =20 When a socket is inserted into one of these maps, its socket callbacks are replaced and a ``struct sk_psock`` is attached to it. Additionally, this -``sk_psock`` inherits the programs that are attached to the map. +``sk_psock`` inherits the programs that are attached to the map. A TCP lis= tener +is an exception. It gets a ``struct sk_psock``, but it keeps its callbacks= and +inherits no programs. =20 A sock object may be in multiple maps, but can only inherit a single parse or verdict program. If adding a sock object to a map would result diff --git a/net/core/sock_map.c b/net/core/sock_map.c index efe49551caba..282c6a4b2b05 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -228,6 +228,14 @@ static int sock_map_link(struct bpf_map *map, struct s= ock *sk) struct sk_psock *psock; int ret; =20 + /* + * A listener receives no data. With the callbacks of a verdict program + * or a parser it would no longer wake accept(), and its children would + * copy them. + */ + if (sk_is_tcp(sk) && sk->sk_state =3D=3D TCP_LISTEN) + goto no_progs; + stream_verdict =3D READ_ONCE(progs->stream_verdict); if (stream_verdict) { stream_verdict =3D bpf_prog_inc_not_zero(stream_verdict); @@ -262,6 +270,7 @@ static int sock_map_link(struct bpf_map *map, struct so= ck *sk) } } =20 +no_progs: psock =3D sock_map_psock_get_checked(sk); if (IS_ERR(psock)) { ret =3D PTR_ERR(psock); diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index b9761af13989..aa904ded816f 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -777,7 +777,18 @@ void tcp_bpf_clone(const struct sock *sk, struct sock = *newsk) { struct proto *prot =3D newsk->sk_prot; =20 - if (is_insidevar(prot, tcp_bpf_prots)) - newsk->sk_prot =3D sk->sk_prot_creator; + if (!is_insidevar(prot, tcp_bpf_prots)) + return; + + newsk->sk_prot =3D sk->sk_prot_creator; + /* + * sock_map_link() gives a listener no programs, but a socket which got + * them in another state and listens now has the psock's sk_data_ready + * and sk_write_space, and sock_copy() has copied them. + * sk_psock_init() refuses a socket that has sk_user_data or a ULP, so + * what the psock replaced were the defaults of a TCP socket. + */ + newsk->sk_data_ready =3D sock_def_readable; + newsk->sk_write_space =3D sk_stream_write_space; } #endif /* CONFIG_BPF_SYSCALL */ --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.52 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560904; b=Ra/iNT4KuEy1viOv31hqveHyilA1Z4kLpLSl7jlEPISSVZimAuaoLyETpD+cnDpa5xZV euZmMCUmqXzF4e9jITiKtXJkv4Piu73Rtx/YAEiOwzAhP33QTKxpgpapm/OhyBS963jaM enikxGjt/uQ1EQ7l547zXnzITa8tHt7ad8jD7D67lfkEj0G2vZ2s77esSUS6JBSIP9bYA mllTSSiShwGpOs3WAjoC+BhXoaOfWXjISBl25KovJeb5fbOJgaIW3OcjHD9bPJQRdTEj2 3wzyYQa5Wtkcm2JMrdJ+HS9ww9lgl54Wpdigjus9iZ2COsw7ppr6fZz2vRb+pD8BRzw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560904; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=SzMjUS+/JylIFqehNQ/NUtqKceY36ervniTve9Rd0yE=; b=iPgaClv8lumD+6espjLxqovicEwGntpmsGsum1tffoNu4bW8n+GBkYKMHFKgSu/ZK28Z 67N1EFM7ig2EPjXG6FKvB7HpceR9wTWhkY9kjZu/O6WilZn6K3lsgnsccd43bi5NIaIoI xYHS+650a0wMJQu0ad67lpaetFPZ4EM8zplF426GthuPQ1a/+x2hbsOXDHtL33kDHIFcq DGa9WtGLcXWJye4G+xVUqgW9y5knr3lN3MYeVVOjo9pulq1m16LUxdMekvBrbqy2vU9Xc BKZahg73busBqsIaNs3l84RkNOHoghid/ObKnl2CLRQWafuxad24zie9/ULjWnue5jw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b="TAS2mQr/"; arc=none smtp.remote-ip=209.85.216.52 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A0EA606A324 for ; Sun, 1 Nov 2026 19:21:44 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 4A0EA606A324 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=TAS2mQr/ Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-3aded3c6103so1048765a91.0 for ; Sun, 01 Nov 2026 11:21:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560904; x=1794165704; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=SzMjUS+/JylIFqehNQ/NUtqKceY36ervniTve9Rd0yE=; b=TAS2mQr/QQq7q0+YnDpMt4sN2Qpmgz5k6xzqiq8vFH0Zj4IbC/oLDW/xr7A3Qr4GPq XG5mS3BcVPIHsH1vrlkP+SUxJadKwygxMRjnEKrPz4pnMFAxK0IhqNUSyDIn6y4npxaQ ZWBItFeBNarcFVYoC00gkXSVAlFT4jWmKi71ml3WMinAlye94N4vcWSdC1+D5xDdZLno rhG/9mHmB99b06uxZA9zSOfxUeKYtgy9PjgYMiD7lFbGh0LV2qh9VEmrsMkG832pcuU4 5/zN63zc6Oca1Dq49QDXacBjblEAFQ4ilvWkqd6JCLKgfxwSTowLJ3yF6+HHP2kUas1W og1g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560904; x=1794165704; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=SzMjUS+/JylIFqehNQ/NUtqKceY36ervniTve9Rd0yE=; b=X6HGS13L2xeUl2UgJjGgM7+A3/OxPfLgA2fhMHiu75TCsSYoQhWIPwu+DOGooRte2Z zUIObSy64YyxzMjTUYvEA/MrTeObBdaoK7QRKiPyHDAlXf8jyGumfMjUcg/UyrJdPViL bukEr1BDB6llq2o1JsQAVtmihjfubNywGXirjKj+CuR/f0E9g95PCwZ7h+90bn2C5On8 k0r229QMvuuD9EyT0FTTPqHFr1m4Etiw0yWwTjIRmUirkid0zovWHa6bIrCWoicemXX1 cWTM+9W6ofKWjIQ23noK/waGqJAZsZFLtSs0OYrpEVAFqZ7SSwgaSUcxsmiRgVJe+LYb VRKQ== X-Forwarded-Encrypted: i=1; AKwUvBzoeJre8tsUXpy+Ob+oQg3a50/HwunAW1H61mbwhR4xeU8EjqyxfDrtjBl56lAGaS1LHssyOg==@lists.linux.dev X-Gm-Message-State: APuU4Z/VdAGqoH4ztbExjebkh4u9eM1R31Dv3prqMun4q5Kdds2Yb0aC 2UkGk7pTCj4rTIfSwpeFE8b2PVXG6At89hUbng9f+gQctkRLlQroBb8g X-Gm-Gg: AYBFou0gC2GUSFQsKjvVwsblolQzr2apohwSI48z3QMIwjwXw88+l31JdUHy46wTSdg ESUo2cJ5ZFipY9zRlIyeg34sfSuOlfa3ECVW008OzweFd9ohVERqN3tLbvPgl4Jos6VTRssatuT mLtkxjAfU30Vg0UJtG/q7vy9LQy7Hyy2473rFmh6zgOF+SFYhIpjq/DHuiuIX2arkXImTEqembz ppuflsHDpq3bdfTmD33CuikPnpcmyORxbO+FJHZ9XPvphwNDTMrM/qKZc/lEgX6GT0Wdl9YmuM0 ENr2SM58vSC80d1s+SeCPLtgRWLaZ+pddcue/M7sYpMWP4oun8S3kQHF4S5nlUdr5g8Rb5mO/J3 8hVFewfcwePFT0tqmRiZsiLEHY0Ou+TfW0F0VU/D0m+fKboUQ2djh5vwIsI4QFJUB6h6FpbeZI1 LwSA2wWXHkmFuVTcCr4msI+ZYUSPK6LGmxtus1Y70jVy3jvMTmdTNKk00eQVzWgEOJZ9r2nKipw 0srPHUk8Tn//BnQmsZ4azVBjHi81k/JPWPIpkLOx5d36Q7fwnM8UlWPhAuV/t2RRAV2m+FB+aK3 ekBsfCRqFgh6eoPIoQSDk0efyFEiXJEq4H1kKbwZ9gm/Ds+0STd+be9MIe2J3AMZdQvGjWRqrZp sewRoRZGaUwAaABjYiicUl+TXyKELeivgm+6KBe6pexUkfXf6TKXsDbalxJghBlJ+Xr/6fBI+kw == X-Received: by 2002:a17:90b:3f84:b0:3ab:b39f:41da with SMTP id 98e67ed59e1d1-3ae89776af6mr6425348a91.11.1793560903588; Sun, 01 Nov 2026 11:21:43 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.250]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae85cb1bfdsm7009849a91.0.2026.11.01.11.21.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:21:43 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 07/15] bpf, sockmap: Check the target of an egress redirect before each send Date: Sun, 1 Nov 2026 19:20:49 +0000 Message-ID: <20261101192057.2296489-8-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Chris Mason tcp_sendmsg_locked() expects a caller that has the socket open. It uses sk->sk_socket and the wait queue sk->sk_wq. For an egress redirect of an sk_msg prog the sender calls it on the target without a reference to the target's file. Both pointers are NULL before accept() and after close(). close() can occur while the sender sleeps. Then the kernel crashes. Fail the redirect when the target has no struct socket, or when the sender has to wait for the connection. The error is EINVAL. After close() it is EPIPE, as today. sk_stream_wait_connect() calls remove_wait_queue() without a test of SOCK_DEAD. sk_stream_wait_memory() has this test, but it can still use sk_wq after the sleep. This patch does not change that. The target can change while the sender sleeps there. Thus do both checks before each call of tcp_sendmsg_locked(). Clear MSG_FASTOPEN, so that the sender does not call the connect code of the target, which uses both pointers. Today the sender can send before accept() and waits in SYN_SENT. send() with MSG_FASTOPEN sends the data. Today it fails with EISCONN. When the redirect of a cork fails, send() returns success and the kernel drops the data, as today. The Fixes tags are for the two checks and for MSG_FASTOPEN, in this order. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Fixes: b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap u= sage") Fixes: c5c37af6ecad ("tcp: Convert do_tcp_sendpages() to use MSG_SPLICE_PAG= ES") Signed-off-by: Chris Mason Signed-off-by: Alexei Starovoitov --- net/ipv4/tcp_bpf.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index aa904ded816f..b635d3ebf4fb 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -88,6 +88,24 @@ static int bpf_tcp_ingress(struct sock *sk, struct sk_ps= ock *psock, return ret; } =20 +/* + * The target of a redirect belongs to somebody else. A child that nobody = has + * accepted yet, and an orphan, have no struct socket and no wait queue. + * tcp_sendmsg_locked() needs both. See sendmsg_locked() in skbuff.c. + * The sender holds no reference to the file of the target, which can be c= losed + * whenever tcp_sendmsg_locked() sleeps. sk_stream_wait_connect() and + * inet_wait_for_connect() go back to the wait queue when they wake up, so= the + * sender must not wait for a connect. + */ +static bool tcp_bpf_redir_allowed(const struct sock *sk) +{ + if (!sk->sk_socket) + return false; + if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) + return tcp_passive_fastopen(sk); + return true; +} + static int tcp_bpf_push(struct sock *sk, struct sk_msg *msg, u32 apply_byt= es, int flags, bool uncharge) { @@ -109,6 +127,10 @@ static int tcp_bpf_push(struct sock *sk, struct sk_msg= *msg, u32 apply_bytes, page =3D sg_page(sge); =20 retry: + /* Only a redirect sends data which is not charged to sk */ + if (!uncharge && unlikely(!tcp_bpf_redir_allowed(sk))) + return sock_flag(sk, SOCK_DEAD) ? -EPIPE : -EINVAL; + msghdr.msg_flags =3D flags | MSG_SPLICE_PAGES; has_tx_ulp =3D tls_sw_has_ctx_tx(sk); if (has_tx_ulp) @@ -547,7 +569,7 @@ static int tcp_bpf_sendmsg(struct sock *sk, struct msgh= dr *msg, size_t size) int flags; =20 /* Don't let internal flags through */ - flags =3D (msg->msg_flags & ~MSG_SENDPAGE_DECRYPTED); + flags =3D (msg->msg_flags & ~(MSG_SENDPAGE_DECRYPTED | MSG_FASTOPEN)); flags |=3D MSG_NO_SHARED_FRAGS; =20 psock =3D sk_psock_get(sk); --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.215.178 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560910; b=GgG4bS8QmtT+4jHZbC7iZ4jTfiC+V0vtuv/7ciMzYr+BlVhtQYvM3dhzSdFbrgyxDdvB G+T3fGKMCK/MUJ44B/PF5IM8fD0ytH7bJeLLJjaEzEsegSFNgepGh96YoJvaQMo9/6UsR +RhC/QR85ksG+4M4loMuKqWcUIcj6wvY11jj84Od5WdLBGdcWhBClfWWVC0zn4mak9O3L k8r1CZTi+C0+nSyEL3IZdKGJkklCDhQz+lEqPMWEswt+2uTmsv1rpDsPT/fLOPOp71iVt GkNGnLMj+cuT+Ta4AH2HTbtjC2JU8I3XvYuh+zNIKWkfSmh97Z9lRK3w9Ysk9iRIsSA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560910; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=q/uS3MNfywD3Vv+T8KYvUL+u5aHeTIkmuMrEypBwwRc=; b=Rgcrsu2N/LJtWtrtvEHz3ZA0aIlmziiCm/ios/wO0/Bn4YO7w6+gPoEckiuLJrMZ2v01 XtVCLnrHL2dCEinOr4cIqm4hJq9eBN0V/UST+kowBYsVp+BXPomtvMhsrEkSkzOdGVWBB bNfdShAem//YhfLKJ4PxWa7iLahMlesswPxEknNfzzX1Q6eDlYuIYOJWZCynpxocEG+M3 JdcQyckbqy4HVU7ftAve7igx7E1ohu/3FMAO8qWc/6b5PNaEN6yVjeWDEPTlEE7SpOFYF NlcnbnwbH8qmHxTotrSD9/UgTjA/l0aZebQZRub/eqOi7QwX0OK3kDjlrJM5aF4ucjw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=Jq7f7Erg; arc=none smtp.remote-ip=209.85.215.178 Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6AF28606A325 for ; Sun, 1 Nov 2026 19:21:50 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 6AF28606A325 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=Jq7f7Erg Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-cdab6ae1ee9so868385a12.1 for ; Sun, 01 Nov 2026 11:21:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560910; x=1794165710; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=q/uS3MNfywD3Vv+T8KYvUL+u5aHeTIkmuMrEypBwwRc=; b=Jq7f7ErgqM9YnhxpmVdgqohhdW6ednt2TCRvi6j1I2vMP0c1MNySSLhZljdcgJqfIb lD2byqQHMbAKrOnp2cOJqzWl638HshdbtsHHwTRv86zLwneJiU4rvFKHuDJxrm0YmDID dVyHh06SDPRZvS6BpPx8xOjMeu5/DhoJ/fzFUExwFd2/uvHkpt1ZRvdH6ySwBH7fAFdP ZjwpugqmG9+woDvQpHdkp7xwhL6qodr1KCiEj35Rncq4h91ek458/o729beOow2OTeDV I34B9fiewE8xukSJo2T6Z7Dxb+F+Bj5GBcTRGiuBqJuBJ+JigR7QYF3qJiNJIHUbXDHM pHRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560910; x=1794165710; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=q/uS3MNfywD3Vv+T8KYvUL+u5aHeTIkmuMrEypBwwRc=; b=tuxCk7XEksQte4Bm8pDeNb+UN9/a9wCxLouuD2rHNTj59Kcqeii4RUekU7wMiWnAlR prbkQN5ng05mt8IgrB8YCCJpXilBpSzgXbMdLjTpfIz377FQJAKyU6+VR3EBrNX6wyjA uwoNVuOF8x0TetRL2MR9AEwK/xzxABoJD9rjeh+ItVKBr+WG+lkd1DIaP4fP06jsi7z3 k7ncsteTqf0YlRZLOO0XbUJYxHTEWfboZrUBMzMizC4ef6IcblWchfOxo27DZGWY4wD2 5QrlPnBZbOhV/E2NLXmMsiXJOps35gBpTRuHSG9nopXi5GpYMa2K0jumIeFAHYexaLYM Xdqw== X-Forwarded-Encrypted: i=1; AKwUvBxXALcOxjcqasbv0F1aY5Jjb9kX5GrjNW1nPqVHTcKFjsIetj7qt/yU72id3vnBAwiuFkbnyg==@lists.linux.dev X-Gm-Message-State: APuU4Z/lNkrGQNDo9GYgaNNHhVvxF0lVne+fuB6KDFfctRsbfMaANTCy 1dwXY8g1N2hXMKUbGiaiErw9Yn0FRukRpGfcBkAhbUKw4LomXB6K3AAp X-Gm-Gg: AYBFou2vM/o0MCS4ljhPZ0Xc49ngE4twpi/UkgxCaW2Yoldsnflm9XDYjE5XhgUEbjM fqiPfHoGqN5/c6s19x16pZe/j6Et5UeU420fpTiOuz0/gXienTW8jwxCHo4asWmLB3IlvGpctd/ udY3gk+hGjA+sWDQ5tBoqUB+WaIeYnRA3yRREkbZVL//VbqcHgxyusD4Fiy7L1Yq5MHyYp4nYQC 9l7gqQMcxwUXUxO86W2+QZe2pIj2789JrCt4WtwYXupFr9Lit5c9m+F5j13wcFeyjDE+zoGS1t0 HAmEhb9D25v0dwMeoubQlFVswGC7X2TZ4q0CTALlvx2Dst9Gt5gUQVfKsLqc6iTUbt3GUl8RyDY NaaXMxblqHHUEOUMDVleb8jMY+h0bk8fweCUKbRCP+HVd9zuTEgOR6q5LhXzmmMXRTQgX5P0LMx 4W26tnRxVWuXalkLSnUPjt/hc1Q6eTpVz0r7NSLwb0X5KM8kCzTDj2euGRzbyPWQazKDFFGVH+1 vcO9Hvp8lggkOt2D3eMJb732GnARw14jAhMQfbj+onrLcULcoQmdQ3Zibap+0AOwHUhlWFrzvCV 6utxsnKZPL1FG45SufF5Dh1akzsSSPqQNhXm82U4PJ2xGjLGKQGXDW3vqFfi2XdcBQ5nywXMay0 utLng5bgvzBHNk0+15J3DA4TiqAdjecFDNdPzbsY6wE+hJTfnWO+LWHLfCqbjI7OWQpfjR+BN6Q == X-Received: by 2002:a17:90b:2745:b0:3ad:544f:81e9 with SMTP id 98e67ed59e1d1-3ae8977685cmr6101064a91.15.1793560909716; Sun, 01 Nov 2026 11:21:49 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.255]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3aec233ba08sm1097664a91.0.2026.11.01.11.21.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:21:49 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 08/15] net: Leave sk_stream_wait_memory() once the socket is dead Date: Sun, 1 Nov 2026 19:20:50 +0000 Message-ID: <20261101192057.2296489-9-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov When an sk_msg prog redirects data to the egress of another socket, the sender calls tcp_sendmsg_locked() on that socket. The sender holds a reference to the sock, but not to its file. Thus __tcp_close() can call sock_orphan() while the sender sleeps in sk_stream_wait_memory(). sock_orphan() sets SOCK_DEAD and sets sk_wq to NULL. After the sleep the loop continues and does not test SOCK_DEAD. The subsequent sk_set_bit() can dereference the NULL sk_wq. The tests of sk_err and sk_shutdown do not always stop the sender. sock_error() clears sk_err, and __tcp_close() can call tcp_disconnect(), which clears sk_shutdown. The sender then adds data to the write queue of the dead socket, and inet_sock_destruct() warns. Leave the loop with -EPIPE when the socket is dead after the sleep. The function already tests SOCK_DEAD before remove_wait_queue() for the same reason. A caller that has the socket open never sees SOCK_DEAD. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Signed-off-by: Alexei Starovoitov --- net/core/stream.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/core/stream.c b/net/core/stream.c index cb255e2a3a5d..334124d683a7 100644 --- a/net/core/stream.c +++ b/net/core/stream.c @@ -150,7 +150,11 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo= _p) (sk_stream_memory_free(sk) && !vm_wait), &wait); sk->sk_write_pending--; - if (ret < 0) + /* + * A sender which sockmap has redirected to sk does not keep it + * open. A dead socket has no sk_wq. + */ + if (ret < 0 || sock_flag(sk, SOCK_DEAD)) goto do_error; =20 if (vm_wait) { --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.45 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560916; b=14vDvg2OfMWmNFUiO82XiIlouyN/mtfM/V8WCLZQodxbgYkgUOCJE9JYhaiOTC2lLL4D f7JLqyAhMCdqRF5IKXagdoU4FGPur1ZTO2QaeN/bktKI72d0xIQmTB8QsIRWhE9sVzAXQ mAmVZXf+AYKAyyDkA8lQGjNH7vrVEw6ztuTA/MhIRmnXPNOJHC6wGa7erxa0ILYnLOZ8O +HIJIev4HO311EmKyv18vhFa4/CvfbER9phCGWUQo+FP4vwRl8kT53mBmuKVBNAbwDNpG LyFPutSL+yJOOmwEJZHiyec2ETT9qLqTC+/8foUpMFyphYgAKihpZ4E14jCPD/wbK5Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560916; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=iEAaFxE93Z66HvVgBeBCzXXUprLmZg1keqaBn6ibVEs=; b=SEoDpszyWjHzp5NF5/EupHzu5oF3xuX+v1Y8+W4ZkWfR5OJfFKw5agTWDknVm3ZB8r88 E7gWNIoF63gLx2kOaYRrhPO0kRiAkjrcCMu8O9ZK+LVv7WhsH3Ynd5q36mXVIuqJF3FWt l7Mgab+cX21KeaDNIRERXedi8ncL+1XJy1+QbxA0FuBnoliEr1t4cvGeGmMJ82+1Hg12O k4HxsV9GSHUsiz5RBFGMhjtUtxLQEl0vU8B9KHYa5AA8mA23Vx4rUVNinaMOKEwcpsKFs oAjbUb0Q4wD7AT1b/dmu1t5UG6zvfXzxrjbe6X+eWwLyNz9zaugrNcZ8Bk+Vv8csl5A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=lLxPV6Pv; arc=none smtp.remote-ip=209.85.216.45 Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5A86E606A324 for ; Sun, 1 Nov 2026 19:21:56 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 5A86E606A324 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=lLxPV6Pv Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-3acb11973c3so1799540a91.3 for ; Sun, 01 Nov 2026 11:21:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560916; x=1794165716; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=iEAaFxE93Z66HvVgBeBCzXXUprLmZg1keqaBn6ibVEs=; b=lLxPV6PvUhquYwJFPWdzeVD+rR83N4dRpsoMO1e9FSUfMKwWC0Xo0nlYjZvavLHb+F cle8U0s3h7NYfYG0IHl/7d4O0C0t6r9hoedoBuUyZfIDRIT4FWRsV+y7vXmprmikaX7/ NCtISXjfFbg5G1Akfa3d61lPyuixxCQQeR3D6f4tuOR/DJ2WV5QokAQm9jFotuZ2AfW1 sdpDWa2oh1euHtgqiR/2R5ay5ewvb8j9KjV+J5aPfUCY6iccOIy4ZUzuAJ/6hEouRYNj 5dmjghhu1kyodTw4FrwVjpkaqKJw8u8elRd/8/ADBiVsRfscIdwJ4f+dRgYPBzA/UB1H iJcw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560916; x=1794165716; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=iEAaFxE93Z66HvVgBeBCzXXUprLmZg1keqaBn6ibVEs=; b=TundlVEaOEYnW0/zcgOIjBItqPToWWOaylPhJGp/2qlt5D8U1T2ab08n1bei6ovrWt os0IS8SoOXEsxIT+2fCKUshB8vJ2+R2Zk3QUgrvEt54Xt8IYCZBT8YOvuhHS0iZ8K2cN PoXIwEcfw3KtR/6C7pSbN0Eho9z57pDoujHXN4Hc/s/nDTayWeKO9sS/6Rw3IRj4a1uU fef6+Bd3m9paIGOLplzkXlzcJ8NVa/PmKMT8m42I7o5WnkfBuOlsbW2G2E3a9gja/333 u8LokJmkRYESdbQiUprRmAkdsHGjUrNo4WNvXUP0b/tWG5Yi4DVwwQcDxKpbBWpOZGpt jVdQ== X-Forwarded-Encrypted: i=1; AKwUvBwNL2dVlVt9avgAZ41dSEN0RgM/EYEkFgITrLOf9Zpf0zJwiZDzc33YNR6KQIhqY8CBP/Dgcw==@lists.linux.dev X-Gm-Message-State: APuU4Z/6RQf3pKw/Cw+rMp5+Ad5xwsJHwTWrAUyE44VsAFi/ZyWe4XY0 RjMCXDyZ9mfXP85AZzPbzmInzYfgebU9OnfxvCamXou0kvjrPllYxkL6XaXdAw== X-Gm-Gg: AYBFou2ShI1Pfpt0eRTyZxhndciAzTy+rJYddUauQYo1rRS7ui7Ntza38XNvthxn6v2 yyVDB4j4uxgZTE+OrhOo0RsgGNc51eM4kDxH/v6bx801qtletgc2u0Y1Vjo50OXN6VeuyWEA/51 yQD9sOl4H+QTxRPeDmAC/256v1P/8fAhnSLdxJwetOvw1fBEi4mdOrKl8yL2wNbkX+V6VFGR6su K0/UKy0iPHzoL2bQk9W72rg6yZBD9/hp/lBT0XbtYckLniScwTjDyWlEsETv1YV2wmS/ylqmQdy dAuohvKA5jXHr/LNEtf38oJsfWMR4pBIxyF/ZW23bKz7PGhu5SxUN26ny2ZPNXh9S2HvQU+lL8b CxWnAU4mpPRU9E1uEykZ1dH7rbZ7SL1RDh2ptkcm2ray+ORcInb4Wy3PSH5F+aDmiIHIYo62YRl 6TcEyahYEbTq5TEK0YPp1sPbH/XXy8YMjUZ2Rt4EiHisIOHUvsMr8iuOyRqSd42WHz7k60Fuj/T KW8IBkPwTxRiIJHDSMp64MN2eYNWptTWJEgLgGTT98Rf7Kms6XuIHWZUX/eLyctMBbMBG8D2M1j +9SsyscwFfgm4VTuTCp5PlFOIp61nsWn86pMxrhf/7sAkc7wkgmtgTew25mGxNSkjkzEciVAk/Q MM2RBtKLfe8Xz5uQtgqJ0AITh0En8TRTGW1KoAI5c5y1mpyRG92CXzVgOiM91ui8tfLO4hN0h9Q == X-Received: by 2002:a17:90b:2641:b0:3ac:8446:c1b5 with SMTP id 98e67ed59e1d1-3ae8974b804mr6354294a91.31.1793560915674; Sun, 01 Nov 2026 11:21:55 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.251]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae87fc548fsm6851876a91.4.2026.11.01.11.21.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:21:55 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 09/15] bpf, sockmap: Check the TCP state in recvmsg() Date: Sun, 1 Nov 2026 19:20:51 +0000 Message-ID: <20261101192057.2296489-10-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Chris Mason With an sk_skb verdict prog, tcp_bpf_recvmsg_parser() copies data from the psock. Then it calls __tcp_cleanup_rbuf() to calculate the receive window and to send an ACK. The window and the ACK need a connection on the socket. But tcp_disconnect() keeps the socket in the sockmap and the data on the psock. For a TCP socket sock_map_redirect_allowed() rejects only TCP_LISTEN. Thus the psock can also get data after tcp_disconnect(). __tcp_select_window() divides by icsk_ack.rcv_mss, which can be 0 in TCP_CLOSE. In TCP_SYN_SENT the new peer can get an ACK with the sequence numbers of the old connection. Call __tcp_cleanup_rbuf() only when tcp_can_send_ack() returns true. recvmsg() returns the data as before. Move tcp_can_send_ack() from MPTCP to tcp.h. It also returns false for a fastopen child in TCP_SYN_RECV. From its peer the child has only the SYN data, and the SYN-ACK acknowledges it. Fixes: e5c6de5fa025 ("bpf, sockmap: Incorrectly handling copied_seq") Signed-off-by: Chris Mason Signed-off-by: Alexei Starovoitov --- include/net/tcp.h | 6 ++++++ net/ipv4/tcp_bpf.c | 3 ++- net/mptcp/protocol.c | 6 ------ 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index 3560adddf821..23a22d70718e 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1845,6 +1845,12 @@ static inline void tcp_adjust_rcv_ssthresh(struct so= ck *sk) void tcp_cleanup_rbuf(struct sock *sk, int copied); void __tcp_cleanup_rbuf(struct sock *sk, int copied); =20 +/* Is the socket in a state in which TCP may send an ACK? */ +static inline bool tcp_can_send_ack(const struct sock *sk) +{ + return !((1 << inet_sk_state_load(sk)) & + (TCPF_SYN_SENT | TCPF_SYN_RECV | TCPF_TIME_WAIT | TCPF_CLOSE | TCP= F_LISTEN)); +} =20 /* We provision sk_rcvbuf around 200% of sk_rcvlowat. * If 87.5 % (7/8) of the space has been consumed, we want to override diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index b635d3ebf4fb..9848c8e5a2cd 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -343,7 +343,8 @@ static int tcp_bpf_recvmsg_parser(struct sock *sk, if (!peek) WRITE_ONCE(tcp->copied_seq, seq); tcp_rcv_space_adjust(sk); - if (copied > 0) + /* Data on the psock outlives the connection that it came in on */ + if (copied > 0 && tcp_can_send_ack(sk)) __tcp_cleanup_rbuf(sk, copied); =20 unlock: diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 7a22e9388e0e..d62cfbf2d490 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -619,12 +619,6 @@ static void mptcp_set_timeout(struct sock *sk) __mptcp_set_timeout(sk, tout); } =20 -static inline bool tcp_can_send_ack(const struct sock *ssk) -{ - return !((1 << inet_sk_state_load(ssk)) & - (TCPF_SYN_SENT | TCPF_SYN_RECV | TCPF_TIME_WAIT | TCPF_CLOSE | TCP= F_LISTEN)); -} - void __mptcp_subflow_send_ack(struct sock *ssk) { if (tcp_can_send_ack(ssk)) --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.210.177 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560923; b=QltHkU75u3QsfYbr121yadGcjhwjEFaX3+wpz9TwNrSuOVweou8NVjksQGWCEOp7EoVi rHcQShL7kQgZvktSzJFRWSJMeSjYm29i5WVZXxhRMfWi5PHgQY0hRKxxNVTNCJOpS804h E5KZnyuiYQIlj46cu7edZMU0G3Jl/7eZ7i4kc5jUNO8FM7KAhnIpA6UpExdD7cZvzkHb5 1TsSbBU+Hc3leXHAhD1KTI2nej1Yi0deKB8uL7EqsGDG0zKzOPR6wghu/RXq8Z5HyBrTF 5LStewzs6VDfCO2fjM8nYDh9rgVbeyP0Tl3INgCYiiQ8/UGHlX1rbRtMUHZ3dRESPZQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560923; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=XsgHBoShd1l16ZkCMwetUuA2WCLMhgmDmGz78nTCX+Q=; b=4KxDsvVfxdoHtnkAe/sSOSnh5PDXTPFQpKwghjOPYBr0+yTu/sONuToRbt3VHpa8pVSp tV2qrLPljvY8yICQD/sEuyQxHX12qv7CzhVfoddEv06GgQ/lKNQzU3+vB3xFqhnpoJJJ4 jvgumQdlZ/kQp14Z7srLXkXeN+sNvqB3xN/VJYNcGVTutXrf0ClIMd7vtsYh+4PwAc15T B2dl8aYkoA+jF32kP7SUUSFvrk9YbrUT0lofbopBm5XxOl7a/PEakZeaF1A6NLqxmhI/f zXGWXLIjYaD+yzEBPZv5hSby5Hf3+LX691CWdRx6v4eFaSQWAOe2U+03gLasLqxtwJg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=svoILlWG; arc=none smtp.remote-ip=209.85.210.177 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7433D606A327 for ; Sun, 1 Nov 2026 19:22:02 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 7433D606A327 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=svoILlWG Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-8a06b27bf9bso727066b3a.2 for ; Sun, 01 Nov 2026 11:22:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560922; x=1794165722; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=XsgHBoShd1l16ZkCMwetUuA2WCLMhgmDmGz78nTCX+Q=; b=svoILlWGydkDv1d8I9aasts8SBa31mNTcLmBm7xcrbq7xc12ipXyJTJB15LyjrhHI6 9PzYkANRrKdgEetT3sRgdEO/fwnvcuZwAoCd/CDJKzCy+o9I0zNFFdd0M5/vOq7Pmw7k 2RTckcbYmOX96tLYIB3U0sTzI8S+WfzpxD2OXajW7hLoogJUOtxWsqzYfcSiGwgBpd+k aZLrAGN1iA7C7UpOMbUlMO8s+Qu53Dyo4ilPh2h247+kdEqvfwJf6fwcWUfqSScM2IBS q5RNWZCYWdNJCkQgspl0M6E9maq5ukMlNTZFGRfF1Bl9AuB+lddgZEnpznQ8+0hUFfxV MrDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560922; x=1794165722; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=XsgHBoShd1l16ZkCMwetUuA2WCLMhgmDmGz78nTCX+Q=; b=agk4GqxBk7AU6p+T8iRyBxqVn98EN5U6gZgtDS3spR21Q57hwlMEeN1vcSiNRcwpvY Ni99buUwcW8PKxQsA5miuY09VIZs0/KpPat+myl1PzVkgfzYaA7dcPL3DwrZzUpyWBMe XqFQFPjNp6gxMjG1GfAYXu0vpq7xOqOd98uZw5lf9GIYc8BX2BUdvAnSb8t9RAviXblv 3T8hq3qkXuW0hFXFtVj6syi6RMZQ9ERvZWvHPooeypRpy3qm7sllA48oqtCw3+amEop/ 10mHT6KriUr54klDGxnYYcZfOy1XcsAjCqyZtadK8JaeayLnlA3X1J+1xGDH4fOf+A3A wl0Q== X-Forwarded-Encrypted: i=1; AKwUvBw/mqPst6kQ86y329pHesMuCVhQkJRH8RRmzOaNueDOrircUGL9u1fMI0rxP+8YIIaeE0gN0A==@lists.linux.dev X-Gm-Message-State: AFq9FYKOnLt8AwN/cJTOChVEd6ZS+BGxmVrDgYxN2v/dCbLr7+6E6rBL mN4OV+s/vUz5KPdoorOFTqTD6BL+pmYUpna+dYtJb5sJOOcJVUojhRXp X-Gm-Gg: AYBFou2JEcowoFhz2UQQ/9ZkBa27YRu+LDufhkssKtgUbLlFKZcYOWFHWjbRyhM6rgI qxS/topBprjwzWDUAH9As7zTnFIZfAX4FKK/xL9qVMBrvxMFefhLmHTsg95zL6tR3jUGh2e2/Fz 2Sd6tRzUyWp6QXpfquJMtS5n2xCFm/6+2WwDqIgAyaIpaoAPH2ONcaYbXyCCM1X/E21GYrjTAAm LvpuE64LcIuNT7EmqVW2Rm+TM2mBye/mUSFDCVHE5/1q1DJDJOJB2ZFq+/Uln0QscG8DimptAXz ZFMwBkGRe93OlHO9t2TiN9ZaXpnB/yUcjLRRP65Aa7Jl5i3Iq417+QwPhnIqhPb7M99QNiVnwJc i1EfH5ChIHU1FusCV+p7B+hr7pYoRxHASLljSZ9ZoG8j5+tgj7bC+MJYR9OphDAKQjnF0WlFEYU bqgW4S1HONc8Wg2deCG3kTDjgajcqZ3Qxra4iEMtF2i5QpjyhRWJpsa8QV4zK7U4xtgff2iSTn8 UqkLPr5zqLcoq7aWvGo89/fVCLUvX3TTJO4ZnZbc2UIJ2ymB626e+XPlzasCV6X1JLDahtRfsuk ZfFCFl94dz3e5OKf6ESAMh6l9kxlmSdVpVTB6XUZV890v4+W3+Db4aK6/Ts3G0ImiFHQGKdEzxU gRV8I/4J6PT4c0jYM7OopXpmu7nAZmv7Qn7zbfo/xpGkXY7+EM/yOjiFog4UhBbUqQ6pOELnmFH m+nGKD60lmPbd17kd0OLE= X-Received: by 2002:a05:6a21:487:b0:3dd:a196:30a1 with SMTP id adf61e73a8af0-3e928ad8fd0mr5379597637.81.1793560921776; Sun, 01 Nov 2026 11:22:01 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.250]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdb096b8323sm2347314a12.6.2026.11.01.11.22.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:22:01 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 10/15] bpf, sockmap: Reset the copy position when corking Date: Sun, 1 Nov 2026 19:20:52 +0000 Message-ID: <20261101192057.2296489-11-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Chris Mason sk_msg_memcopy_from_iter() writes to the copy position: byte sg.copybreak after the offset of element sg.curr. Both tcp_bpf_push() and sk_msg_xfer() remove bytes from the front of an element. They increase its offset, but they do not change sg.copybreak when the element is sg.curr. tcp_bpf_send_verdict() can send a part of a message and keep the rest as the cork. tcp_bpf_sendmsg() appends new data to it. If sk_msg_alloc() then extends element sg.curr, the peer can get memory that nobody wrote: old offset offset end of data offset + sg.copybreak | removed | rest | not written | new data Move sk_msg_reset_curr() from filter.c to skmsg.h. Call it when a message becomes the cork, as the helpers that change a message do. It sets the copy position to the end of the data. Without removed bytes it changes nothing. Fixes: 91843d540a13 ("bpf: sockmap, add msg_cork_bytes() helper") Signed-off-by: Chris Mason Signed-off-by: Alexei Starovoitov --- include/linux/skmsg.h | 19 +++++++++++++++++++ net/core/filter.c | 14 -------------- net/ipv4/tcp_bpf.c | 5 +++++ 3 files changed, 24 insertions(+), 14 deletions(-) diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h index d5e35f24738d..f0e27b4b929f 100644 --- a/include/linux/skmsg.h +++ b/include/linux/skmsg.h @@ -196,6 +196,25 @@ static inline void sk_msg_init(struct sk_msg *msg) sg_init_marker(msg->sg.data, NR_MSG_FRAG_IDS); } =20 +/* + * sk_msg_memcopy_from_iter() writes to byte sg.copybreak of element sg.cu= rr, + * counted from the offset of that element. Point both past the last byte = of + * the message, after something other than a copy has changed its elements. + */ +static inline void sk_msg_reset_curr(struct sk_msg *msg) +{ + if (!msg->sg.size) { + msg->sg.curr =3D msg->sg.start; + msg->sg.copybreak =3D 0; + } else { + u32 i =3D msg->sg.end; + + sk_msg_iter_var_prev(i); + msg->sg.curr =3D i; + msg->sg.copybreak =3D msg->sg.data[i].length; + } +} + static inline void sk_msg_xfer(struct sk_msg *dst, struct sk_msg *src, int which, u32 size) { diff --git a/net/core/filter.c b/net/core/filter.c index 303c0c44dc2c..e187e3c27999 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2677,20 +2677,6 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg,= u32, bytes) return 0; } =20 -static void sk_msg_reset_curr(struct sk_msg *msg) -{ - if (!msg->sg.size) { - msg->sg.curr =3D msg->sg.start; - msg->sg.copybreak =3D 0; - } else { - u32 i =3D msg->sg.end; - - sk_msg_iter_var_prev(i); - msg->sg.curr =3D i; - msg->sg.copybreak =3D msg->sg.data[i].length; - } -} - static bool sk_msg_elem_is_copy(const struct sk_msg *msg, u32 i) { return test_bit(i, msg->sg.copy); diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 9848c8e5a2cd..d24ebcd7633b 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -469,6 +469,11 @@ static int tcp_bpf_send_verdict(struct sock *sk, struc= t sk_psock *psock, return -ENOMEM; } } + /* + * A push or a redirect may have taken bytes off the front of + * element sg.curr. The next sendmsg() appends to the cork. + */ + sk_msg_reset_curr(msg); memcpy(psock->cork, msg, sizeof(*msg)); return 0; } --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.175 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560929; b=NH74+PWhMZtwRJ+SnzdU4GYq8PIdbX/UFeEJRUq2MJ7Kvj1GnSTj+klDEvfQxzibAy7N rnebpWuYuylPltUVBuqFfl5Jwat/RpwouKHUJlDZXgrTbGwlUrQ35FhUHxr0qO5UGpSTq Xx2dJvFA4DrG2GapTMlKpgd7iGuQGCMdjlVdgJ903pX39h27iv332X9wdtbU27b3PssII p6TU6YndNEuu6BuJgh54iEgoXI018cTbfKgYyeEtBb1tV6HqZ+jAIykM+3GX2XhVTVoZX Hw13+3ASPKXePT6iTh8qCb8UC+BeYjTx0GsL5TT3qcd22LM1croCQB1aAX7C40zUoGg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560929; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=RP1aCEqwa+3rqWDejhsGdqflKxU5qcv1t4TwDR4XEcI=; b=sTmZ4yDXouQB3OERjq8B6fkcdwyvrAokAf4lv+EzBFj4U6b51u3DBiJ30xydftAG85Np BHVuv1BfJKVaQGzUZ9bhpkJTZiJKDQg7Swu5RiC6noRblW9s5IC/kWTbcu9Dwmht+KuQB zX4ds7KcPkbkTaUuc2ikOZhO6bxPGVE1jcfd9+lV1G7HDeFZ20vxsbprqrnWZyfS7Ajku VJnsceFseQSAjdhaDF49C6l+Dvo5WAiAE5Cz1FmNg4aSjy5yKq2aTXW1QxQzriIN2ooFi eWcotRqPk1Zyj9ieDcPVkx9A+iMrdKsEJGpWRB9SUJrLgKQ8FICMVSv8bLfnYF3/PuQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=ByRncw13; arc=none smtp.remote-ip=209.85.214.175 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C34C5606A326 for ; Sun, 1 Nov 2026 19:22:08 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org C34C5606A326 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=ByRncw13 Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2e831e86ebfso13076205ad.1 for ; Sun, 01 Nov 2026 11:22:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560928; x=1794165728; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=RP1aCEqwa+3rqWDejhsGdqflKxU5qcv1t4TwDR4XEcI=; b=ByRncw13p+dUVyte4aVsJJmzw/LLezS+NNyn+B8BPuluutapIve1xbZs6vu3VHnRdm 0pdj+voCa+QawWt96RnIIrQ9zLOCl1+E8aNPg6paNI1XPZUFOisjzpug8FYDf8i4VzO3 rpOog2GAPo70jOaTvDAnuXIUEC+1B4HCl6MEIB65IdrLUBPtpTCoAXqquj2852fSaxcT HarYW18v+M6SXY8fHIxj6exdWZIw1X6k9HmdHvFIJgfIqFxuW2qzufYq53O9OJh/qNCw YgP3K4HnTFRY/sqbAIEFdobGT6RL1acyPQfRK/TvUeEFSQQ8g1qii/7b7JJiauOktGNc KHkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560928; x=1794165728; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=RP1aCEqwa+3rqWDejhsGdqflKxU5qcv1t4TwDR4XEcI=; b=gH/ivOSeF+dCNRySBPPyiQG8j0xMHfcijb7g39ZJ0eXrb4kPtXs9n/yGneRgwQdvBa tyxct+vRpHK8gY5VhRbbeFAqF6CDtXRPcL4j+vsUiTUfg+5BhD4XGHRvr/ANypF9BIda vJY84H+iBcPMPrE1liQPg+tBWt105KLUkui6u7gVGmKp/WQABeN5KgF8tXmNBmzBF/lM at5yDXYR3cvzmip2NdOB6b1pRuIrRzfKgNklB9QcG+A5lfnt2/0Ruw1xp2dis5FMFbUi JNghOiqHBtIIRw/wZ7ojzplZxfz8Vz2V4JE1DnXmGdEk2isJO7Q7lEtBQZ6mHD+EQRb1 73aQ== X-Forwarded-Encrypted: i=1; AKwUvBx6+E8qQD1O/W7pIc/+mckDzYEuzjhJgbuH8AHv90LGMQz7lKRVrKHQm4kEK+d4L2jHFPnxTg==@lists.linux.dev X-Gm-Message-State: APuU4Z//JdrF86sFdsWGkjhtYpSOHg+WfGIoscorfKlvxEtqEkTAwf+R 5Lgh6JKaNjz53k7dVaE36ouTilwxrYOzeSejM9KtYOKnyvU3V/F1XvRW X-Gm-Gg: AYBFou0REJfmRfHDYaNXxf+kn1fM9E7ur8EcFMu4Kdr0pJ3HCRQQzoHNqcSaDXJQmhI pYPHPbeIZcF5JxpO4GVcVoCFnXMReqVshAZSNSKNtbKArIIJycbxS7omsAyvwnDoRSdKrK++CeP geBiAOeRutLXCHkiEnucNDNEQ0+lGpjO79cIiH6yyt6vyc71USoW+u/FhohPLqXqOzQwgt9/zBT Gw/vHdratHWXF8DTpepOnpv76BCrWaggUYsI2PV8aeFL7Rflet0N6801bpXJfmihrO79adqr5Aq PmEFLquSLbQOwyuFbCdTiJOWsWz3zec0p43FQ8DZPJmYJUnVFVi1pLTemnEPfMj5AfHRbCsI60+ Pzda3KZA/DGjrJr0KoS3BMLch9JdTVKD+yF47e3aTm07fBOj6jMteamOucO8CsqZqmEF4/ujahx d3GkGaZs8RdZpV4wJOMsa21Wwvz8Cr0DyAKttG/wtEcwQEKinKIAaeDAmpCPgbxDlv1vp60vXRd joaO0PPxXObVOYlDXyROFIaZoZIDUu0wMIbqWesHIrNmzpL/35GX6W0zd2d24vWvpqjXbN6K59k SB7OjDYcfbJ14eXK1ZXegLFVfnRt1Er88kZunRUDv559LlmT+GhSd2avqNSMb/GUUVoW4AbwZwr zRb42V0pnhrFUNakAA2Eti9ZXxJ0VetET1FrqoOeLV1Uoos92IaYa8SPsmqHJbYXyiEv7nZ+fpw == X-Received: by 2002:a17:90b:46:b0:3ac:a11a:7c91 with SMTP id 98e67ed59e1d1-3ae8983f065mr6222829a91.44.1793560927932; Sun, 01 Nov 2026 11:22:07 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.249]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae8805ebc8sm6392012a91.3.2026.11.01.11.22.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:22:07 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 11/15] bpf, sockmap: Don't copy 0 bytes into a full cork Date: Sun, 1 Nov 2026 19:20:53 +0000 Message-ID: <20261101192057.2296489-12-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Chris Mason psock->cork is a ring. sk_msg_memcopy_from_iter() writes at sg.curr. sk_msg_alloc() adds room at sg.end, where a full ring has a spare element. When only a part of the data fits, tcp_bpf_sendmsg() copies this part and flushes the cork. If nothing fits, it copies 0 bytes. This copy writes nothing, but it moves sg.curr to sg.end and returns -ENOSPC. Thus sendmsg() fails without a flush. sg.curr stays at sg.end, and from there a copy moves it past the spare element. Then a copy can skip the first new element, and the peer gets memory that nobody wrote. Skip the copy when sk_msg_alloc() adds nothing, as tls_sw_sendmsg_locked() does. This pass of the loop flushes the cork. The flush empties the element at sg.curr, thus the copy in the next pass starts at the first new element. Now sendmsg() on a full cork does not fail with ENOSPC. The prog runs on less data than it wants to cork, as it does when a part fits. The first Fixes tag is for the -ENOSPC without a flush. The commit in the second tag added the spare element. Since then sg.curr can move past it. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Fixes: 031097d9e079 ("net: skmsg: fix TLS 1.3 crash with full sk_msg") Signed-off-by: Chris Mason Signed-off-by: Alexei Starovoitov --- net/ipv4/tcp_bpf.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index d24ebcd7633b..a450b1ff3cfb 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -611,8 +611,15 @@ static int tcp_bpf_sendmsg(struct sock *sk, struct msg= hdr *msg, size_t size) copy =3D msg_tx->sg.size - osize; } =20 - ret =3D sk_msg_memcopy_from_iter(sk, &msg->msg_iter, msg_tx, - copy); + /* + * copy is 0 if the ring of the cork was full already and its + * last element could not be extended. Flush the cork below, + * and let the next pass take the data. + */ + ret =3D 0; + if (copy) + ret =3D sk_msg_memcopy_from_iter(sk, &msg->msg_iter, + msg_tx, copy); if (ret < 0) { sk_msg_trim(sk, msg_tx, osize); err =3D ret; --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.42 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560939; b=HdQY0MTB8fCLZwfTn9azFbyeEsR9NDQFYIQO7vQ6oYa5zxVJADI4x50OTP+MoOhkLqRL hYCDbjsMJV1OHHVSSYUEuUTQGtqoNb2RsIiAfmSC2Eb4mcfwRUb79K7l29jjBn0KTyh81 xu5lvuhWQCBrkBr1GwN46EUkDCRRV+Wiqz9dZvEzoVIyV2/ERyGxNPTA3TAcyyAO4IGpS 6qYSbLC0F6z+ZTnloD8xvJKIfESwMPYcjBusd8a8/Q37tKhpzu64PC0+2EUnwEtKAhzAb hmZeyx0QTzH5eF3okOaBI2k9E5nq1ArRrNTx72hjMGRqnLiionHDn+f5Mg+tvnegOqw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560939; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=zkvPy8BTXAWTFCLyRVJ2sIoHit4yKU7xsRMx7Je7ku4=; b=QrGdtiOgcYktLn20KSIRIKxNhw+MGj3V3quSw6ypT27bEREcRxPPXHHkiRts/AM5TiSq RWZWbUrqxPIGwWS6Z8KG2h6xE8jJ+yx0ZwGdGAKGeQ01ttnBY3XNtXpnVNGdSJTGCSt2z pizoXE11KF3HCM+O4a0OejpIv7qygZDCcLb7tFOO4pcU4TcyQu8p1xqClstCLPeEHIpHV SnRRkYSM89N9nLYUDKb2ly6ktkMOT99te0J2x3YF4M1E05/N2AmuLETZATITqPc6obIKi vobn3ItdKlUMcHnfNmsluncfzjGR0o9Yu0l3BhloMoA1DKxls1e19FE5FhtWEnFtUYA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=yWpVjhk0; arc=none smtp.remote-ip=209.85.216.42 Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A6869606A332 for ; Sun, 1 Nov 2026 19:22:14 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org A6869606A332 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=yWpVjhk0 Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-3ab60ff4273so1891062a91.0 for ; Sun, 01 Nov 2026 11:22:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560934; x=1794165734; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=zkvPy8BTXAWTFCLyRVJ2sIoHit4yKU7xsRMx7Je7ku4=; b=yWpVjhk0EwmMem2o8wXs6FZVTRG28wqfrBqJkWK0YZbIyVuThCI8lBRnxQ7UyCtuc5 aYrXlO8N7SQQFDts+puF2PQ5jugezfp9Stn7z9MIyKX31KeBoWHFHot7neVW2plY7xwB rDlP0BpCwcFc1B5n7Jb89sCGCTNF9aVgCL6Zn3XUfh/4S+nJ/lIif6ToEm9pxFKiTvhN PWNxRTUiy6Ak5NXDqFIvLPzM7HEByAV/9cs4nZCb8jZH9iRfPjIRSQT69d4SOM7GS2Z2 utwtOt/UUPfjBBTgwcDsV1HeZMCjOltDsbBwm3BDY7bol2Sm3QIN2b99dyz/JSBPx2xt hL6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560934; x=1794165734; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=zkvPy8BTXAWTFCLyRVJ2sIoHit4yKU7xsRMx7Je7ku4=; b=eakVuoTnohJyIr93OlTxFhr727pk67uir9itTp42Zyos+ptmURBFJsybjyn5RaiOjJ dtsidyn+1uo2+FoPjtiKc5bmSzcXkTMe86VFSfVugLl42gJOAL8tgDl+NQscXIauAGs+ nK+/pe/CJYBycqHpRSsMshutvKQUzw5soilDig1lShG6zVK2KLmzeOtAl5eRwivLRPsu XVmcbKLQRm2Z9Rcy9EWxekTZKHqnYpnt9gPmiQaK5e9OcQjz1Ra41ni4nxtmXvh1Y4om a1OGQrCFunijFWi0KzT1D2UGs3RFT/g7ajhTxp4lhHnM7Bx05r8rtD9Q1BDEfQ5C4a41 Q1QQ== X-Forwarded-Encrypted: i=1; AKwUvByB5gKFtqlFq3P1E2tUyrDr8MNplCTwZjGHufbb+dkmjEapVRv3Rlai/ErJl44HqbF2Dxd2YA==@lists.linux.dev X-Gm-Message-State: APuU4Z+sdJLzRhpyoWd5YxOvR/mS+AmDB6SDLV/caD9Nqiz7b+qbbzeZ XkuvVFZDiXc0kVenoQZbKm0PKqrOwqVIwrxBUEhjdBLg1K+fQV/ObeDL X-Gm-Gg: AYBFou0rKG5sQU+8xFaWrn/O2Lw0N2w4GiUg7o3NFGacxOJ+Je1S2Y3jYnKCdADk0K3 hyfXuNfC593+VK0O08ko06z5a+G1C67I6OwSyB4BUZAwlwNhcYxwCKnliMHnSH5Io64bTJ0ykJv hM/3cRhVlj8z35WXmNefSYfalxlCPwtydUMN1ruBliWa8dbB3gmisLtsYSZMqTNWg23cv471JMN OkF79ckCI9VTXvUc676/X/n4iQSibsSWeLyKBZNXWDWRFVqisAn7hJmdJcD7SbSj/FWYoIIJ/wO B7deqAap892HVNDnCxKkVQXgcE8cLVeVIQH+yBj2VNyck3sCdoKeOoaSWD2ESY7FcplZzRyFmdh FQJDzB4QUoSC7dPebmel+1QKo+4yAsbJmqqTF74x/WGLM0vxi1DLbcsw2Yaf2BfQ9HfPK4+Dpcl azXxoRUgP7JJx6WrzhTcURyxtaumXCKHDuMb6szge4YkVv51bvUtwUUsEuiE37ouCM9278KiosJ nhlmEw5dHn1+QrEIyjDg5nIdWMeHj7BXyJlyjQDGjr8iUxipdnNArQh0WNINkMW6z29jX51AtnA C6Eda/HwcnXIEEBf8c0hzicxiE2gob4Tj6+FqWTbD6E6PhnH/pH3BkgddJyPisrlKA1lCe+1E1b sJYmaNB1MHxCU2tbaget4mweJ3NEMUd8SIZffIewLnYHQLCGb9QeZCyT0rOCvGwwZSAwMks8JKL g= X-Received: by 2002:a17:90b:1c92:b0:3ac:a521:959 with SMTP id 98e67ed59e1d1-3ae898166c8mr6711734a91.29.1793560933989; Sun, 01 Nov 2026 11:22:13 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.249]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae85f37e7esm6486678a91.1.2026.11.01.11.22.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:22:13 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 12/15] bpf, sockmap: Clear the redirect target before the sk_msg prog runs Date: Sun, 1 Nov 2026 19:20:54 +0000 Message-ID: <20261101192057.2296489-13-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov bpf_msg_redirect_{map,hash}() store the target in msg->sk_redir, without a reference. After the prog has run, sk_psock_msg_verdict() makes SK_PASS a redirect if this field is set. But tcp_bpf_send_verdict() runs the prog again on a cork, and on the rest of a partly sent message. Nothing clears the field between runs. Thus SK_PASS without a new target is a redirect to the old target. If that sock is already free, this is a use after free. Clear msg->sk_redir before each run, as the skb verdict paths do with skb_bpf_redirect_clear(). Only SK_PASS without a target changes. It now sends the data on psock->sk. Then sendmsg() can return another value. A redirect that applies to more bytes uses psock->sk_redir, with its own reference. The counts msg->apply_bytes and msg->cork_bytes stay as today. Fixes: e5cd3abcb31a ("bpf: sockmap, refactor sockmap routines to work with = hashmap") Signed-off-by: Alexei Starovoitov --- net/core/skmsg.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index a5d498982848..8a3b8536c0c2 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -936,6 +936,13 @@ int sk_psock_msg_verdict(struct sock *sk, struct sk_ps= ock *psock, =20 sk_msg_compute_data_pointers(msg); msg->sk =3D sk; + /* + * The prog may have run on this sk_msg before: it is a cork, or the + * rest of a message of which only a part was sent. The target of that + * run is not the target of this run, and the sk_msg holds no reference + * to it. + */ + msg->sk_redir =3D NULL; ret =3D bpf_prog_run_pin_on_cpu(prog, msg); msg->sk =3D NULL; ret =3D sk_psock_map_verd(ret, msg->sk_redir); --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.42 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560944; b=cbxCg9zr1WAFymdobm7lgl0NbBCTKBCHZgudtTu+QNZASf9JITDi6uIcecP7+Vv8lhIU v9BHgF/jHMH0f60tDJ59CdMmi72Z4MSgD2iJNTX+43D/J1fE0JOP5BS26k3VTmFXpVImQ f06x8y6AOip55X9/fIaPh54+D503o5SytmBljHGNGYDmbC1K2xiqoxSUt2/s+ExWJvTVx MevmjSsqwY17/mhujJe1rb/lxuM9TZSbh5RZnRDRxZzQP7pa1j4wMKl6BOLAud1O5uKKz 0Bae+6mPCR85bfyFmewP49Jll+YCaqZEKmVBlgMsS+GzGhcT1KXzV4rIWAIxEex+pcA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560944; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=Ri0soL3Qksj5Kdn3SrP3no3I/aeDctTXiNHb2hYcsPs=; b=GeFF+Ny4yF5SbILCVjQRWBb9RET4iopvryhJlCy7B5SbWna+yUGBS9pvU0QJQvaP7jiI udIYHvRbjolW9Fe3SeWfqtvGAiXdg9Tc841BcWBwRXfbcqNmsmDN289SbV88cTmp1m0D9 aACAlIlt1xvXioA+kTF6QHp7qct8Q49Hc+HL80LHAQ9UMnBmG//XfsdRsfhUU8M5dkyMK /acXruspmPsQcB8Z11+cj8mSXeMzI//RMq8JnR3+w+xDG3MsVkBPlMvkr/40eGaXuA6v3 D1CQYCdtg/P3jy7zAI89Ev7OBP08Ykdo2DuG/+qLCljkKllRee5SwzBCyn1a6H67U0A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=xfnQQD+b; arc=none smtp.remote-ip=209.85.216.42 Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB0D8606A331 for ; Sun, 1 Nov 2026 19:22:20 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org CB0D8606A331 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=xfnQQD+b Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-3ab60ff4273so1891093a91.0 for ; Sun, 01 Nov 2026 11:22:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560940; x=1794165740; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Ri0soL3Qksj5Kdn3SrP3no3I/aeDctTXiNHb2hYcsPs=; b=xfnQQD+bL+Kup3LvQL4hrXKPPiiAfX6IPhqu7ISlVJTpEnH04+f5qDn5piATmm3gmT B8+Qo5YSnsfjxEmwt9L3V40PcJkz7L+SpJRo+hEwy5xmT1ntyRHERQ9pxQUwWqgF2+Ym 95v+u6xbkppRR2AOtjenZ08rNN6kKEwYpe2C68hmKjYAwkeCi/I/6ptgkbLS+nlMZIYV /rORbUmdw2OBNGrJjGdHClNy5AOWNll/eTRiDuiXjuBLxrwedoxyOWZBMORU3N0wefuC rkT9O11eicEj0xaXs8qKuI135hn1DPRrxGoVdUU49YaS77wV3XbxyJW6jYz3ufrzZUKQ os8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560940; x=1794165740; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Ri0soL3Qksj5Kdn3SrP3no3I/aeDctTXiNHb2hYcsPs=; b=FE7QximcpKbS4uajphb7gbOU5i48B9BYojgITHups7j/F9l5ZhK8HJV70Z5LwQl1Rd JQq5SJfpl61gyWmkxlM+jopW/MgUfs16Ciw/XdvFzKksTFfkobHXXRN43Xoy3F9GSuqh Xu5KeulfFLYuyZiKO8ZgnUDRfYCTf30zeYYPkJ2RjNturrzLDY8XbdxlgM3HAAMMD9NU Is7xkIdDUvvTy+Z/ZgPd6i+FLpcRsg2eDKBmSNpWPD0AAGjnLVRSS1IETShpAaLS56Jh klm/jrdURn91fzSaj1gtKZDnPxfUESJQu5QYQBFQeU9GnuFq/U3AUNz5/1E7hpwsXCQc vuCQ== X-Forwarded-Encrypted: i=1; AKwUvBwa3QgcXvo2SK6UL0tDj87LYpPBp1KSvIWlk1Kad0hVzi0ac7vMAvLeDapoElqjDtgyDMF1wA==@lists.linux.dev X-Gm-Message-State: APuU4Z+wZoMRLDJ+y+XAopq3aMuqpDn9Xtif5TK1jDsdEJrLlCjrPdGy ueQuKe7wShxSndoPlXkj044Eye6V5253NbJEyU5SEQZnVs4vVOcP44vX X-Gm-Gg: AYBFou1w0O4UCs5qG/ACIfQN0Z1qX3LGYy7ed1ofyXP6HaZGy4wfhHrLbatO6jSkFRd pKkJnDS/D86LvLVX2wOuAkwR5H4Z9Ol8F4iIrnFP4jBTuLZeBrMDVinLG2SEchvBj/O7Q3W16jQ kuG7sr/pVo+BjxmMu9K5rX4OFj15mhyYqjboG5UnpEmHMfHLUNtG4ta6DLp1YspeCUMJIKft224 L98VjBPGX/k6291VRbb128sryNdneKzi51dtX5JRww/Ml/RFiBAlcJLGPfddojFTMi1DXe8wL4A qOWXXfz3KsIX9zZAmpGeYIds8o81PhiAjL2xbNoE2gNnHnzmwS2bmqBZV10JLadXPOfTWKNynG8 5nImFz3Ers7N7NjlsJN0yocHp/1vkdDxlUnAnfkYR7Etr9DsymOplDXFxKLjoiwVVm+n/akfwd/ cZHaZmZdC7fEnmcQW7+4w/468T9jeelPoidNsPq8r+EBG0lRrbUhv18sVkhj+acBOf4Uit5ZEwj 3VtLAtr0PFmen/OJj/yNy0FMJYmUv/1iX7WTIbs8+E0NaqBqrmB9FR5iLsHQdKdLBfORbKKn+Zw OsZEA+ggKiT1zDXFeuJ6NoTD7Bo971Qya/gfpT+dEQ7kMelgNDK7agfbUnI27C0MEBItB51loq+ gCa/tJAhDT9df7efk2kjf2tgMWbMZmb9ZThyDUTNSSBTEz41B5KzDe3/728YRBrMFS6ge9wquUo s= X-Received: by 2002:a17:90b:5344:b0:3ab:a3ee:33ad with SMTP id 98e67ed59e1d1-3ae897eb378mr6384359a91.22.1793560940036; Sun, 01 Nov 2026 11:22:20 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.255]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae6e7d429fsm15190285a91.2.2026.11.01.11.22.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:22:19 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 13/15] bpf, sockmap: Check that the redirected message is the cork Date: Sun, 1 Nov 2026 19:20:55 +0000 Message-ID: <20261101192057.2296489-14-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov In tcp_bpf_send_verdict(), msg is psock->cork or the sk_msg on the stack of tcp_bpf_sendmsg(). If psock->cork is not NULL, the SK_REDIRECT branch sets it to NULL before release_sock() and calls kfree(msg) after the redirect. Thus the branch assumes that a cork is msg. This is not true after release_sock(), because a second sender on the same socket can make a cork. The first sender can run the branch again, and then psock->cork is not its msg. Nobody sends or frees the cork of the second sender. kfree() gets the sk_msg on the stack, and the kernel crashes. Compare psock->cork with msg. Nothing changes for one sender, because psock->cork is then NULL or msg. The other branches do not change, and a cork is still not safe for two senders on one socket. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Signed-off-by: Alexei Starovoitov --- net/ipv4/tcp_bpf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index a450b1ff3cfb..9bdcbb0a5998 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -509,7 +509,11 @@ static int tcp_bpf_send_verdict(struct sock *sk, struc= t sk_psock *psock, psock->eval =3D __SK_NONE; psock->sk_redir =3D NULL; } - if (psock->cork) { + /* + * Another thread can make a cork while this one sends msg + * without the socket lock. Leave that cork alone. + */ + if (psock->cork =3D=3D msg) { cork =3D true; psock->cork =3D NULL; } --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.50 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560947; b=D0lPebpb8U3kPcieVKzy++X3nSgh3NF3fYih7zNXN6QES3z/ZCyynaZo3ZXxMnOE8Ngb caitaMva4wBiXKlh4LOGflXUqmYo4JUwlZaSOECrTgW9ceiDnx0aP7CZXagI5swyLi8Hz D2vFqYSLEcEGqPpa6eYyCBpZvNCeLIDJ0GQIS3U+o5fZVjLMcQ03SYlvM7m/Fru665f55 InHTm3S+MB20crPxmx+61EHvnxXpDizpZNrkYNpG+LojgIvWH+9rsVg4lzqRddKRhGVZE PSDq+NnYPX6pucO53H4iQGY5eyBNpPDttUr1wSoLtCBOwGSpZ/jUShdn0AvRPvmOjhQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560947; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=pLfQTSZWiMHhpz6dJ4D5IaCGs2afSNTfy0DFwwVYQDQ=; b=wPiFdjtQNm3L/28UdiNgxt3FVn1McQ+vGFB1vJ/0p1PDjULGOqoftXEIsqZtVrHwZCMe YyLLujOL6+WV76V0KnYVcpKVplPgI132ERmorZl+zY7cj3+L8n/bW3fRHNvvuxeISakH0 GYc+TSI9ppp8EEiG7EOHPA1w6/zLI/kta45kzjqVyM6armoj9W1Cd+iuEo9pdG4B0dZt2 pcPpX4JOBpntOnC+Yrd1kqHKwFtDkINejCBvEdAvT/cg9xOBVc0+m58v5QoM5XSkTwZZF 63rqNEDZyMHwO1KzhgCvQ8ThDNqYSIFbzY7SOpGOV3YYsHkErTj6jYhkzMwksWEkRLg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=OYsXTouw; arc=none smtp.remote-ip=209.85.216.50 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C241160A2612 for ; Sun, 1 Nov 2026 19:22:26 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org C241160A2612 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=OYsXTouw Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-3ab98332238so1199239a91.3 for ; Sun, 01 Nov 2026 11:22:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560946; x=1794165746; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=pLfQTSZWiMHhpz6dJ4D5IaCGs2afSNTfy0DFwwVYQDQ=; b=OYsXTouwDcGEbk0gfkfFTm1iKNnPu5Cvr1azRRUjFibcmXqoMuHVx3VVBQS8G3CB1d EGa8qS+XPod6BLlSwVsOnNOvoynB4tpFLBpBJcjMMxdOednjTYkvLFZtfWajOkjlGGC9 JmqFIMmqoN681eAfFC4KUVKzaXxkHkKUlmEI4i9OLapePau5XTz90vkPbrxrXhK/qr7H x6R78Lcy/6J4z4oh8D6EuEg5GITT8WaT3T7H1vyMQlkNTku61yHDwStfEUdMCYr2fKux Hxmdq7ISntk3WtYcBFyEzBzNUcmS0OhMWeWBiRFIBgmyF3Xu+KkTUo+Z+5wn4bfeko5M 6ZfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560946; x=1794165746; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=pLfQTSZWiMHhpz6dJ4D5IaCGs2afSNTfy0DFwwVYQDQ=; b=SQknXYIhLNYTtZcKS9aIxB2yTtZahnFZcKHS6h64JlEzL161rxCSubkmnk8yE6XWFM gQb1wqxAn1y9F1Nq6dhWs2RKQokkPUGSn56CGxKM39qqFCcC13ZgnLmchljuJ6zAdzww Wwb6nQMuqMTPGZlu3qvNilhGnc5aWdZhHgvxSNmSJ8jPfp7/U6EUz7ZJakqYpsgbTRQK 7WA2cw4olCRQ+wkRYAA99mwZPPlFTvjaBVpWQXOFbna0F+HCvJ+1WlqUvCK8SSrqMeeX W4CYy3bP6pw1G04v1pi/IMSMqHFVxReEquPq9Jm800yX5OhyPp2G5cVjAeYBAGhTPdz8 CWfQ== X-Forwarded-Encrypted: i=1; AKwUvBzXas9nq9aLo0FHmLyxAujxlNvOhOQkCAsnmlXpoJCdQb6CmF+r8yGtr7FaRCWE8mtZ4u+KoA==@lists.linux.dev X-Gm-Message-State: APuU4Z8JwupGPV0RR7qBqBQPBo4NAj3vGdwceB6GmkUP2zPIfeIM2QS/ SehiESylV5BAuMWnzSLEC8vBDVLecT3vFqoGt6m1ncsXwLtrl4vJyX5p X-Gm-Gg: AYBFou3P4kP5SX95pzptmOYLq86BGFyhDBs0tqZPAG2iD1PZYKCzcLy/ZyauyTpTiDH gtHhBP2iynnBrX6PVDStugUohy8WiHScDvLp4FZqjSofvJQO/4NXXadOYQLsxtvYxLsGiZ1qFCL QKCs0h5IcvqH8lOsB8wrXiFTgzZt8/nFCfCqDVTGOyfrH2oO+eo/Ut/BohISuoCl0yqSvAiFnax IObL2e0RKRILKw+k1jb57h0KvUu7PtzDgUfV92M3yd4VtyRxn18tNbc6/G5/RauedZucUrwjS0M oZMKvIG8e+ovUnp2wTD3+IdymIJSrtGubSGYvdRBTdb2BlcSpIVqxT6dcozcuV1szEPKl/M+UEi 7KszPtGZVwuVSiyNlpBVkBfVj6WHpO9mFA8ZUF3iwcbPY6TKLs+ENQoDk83L1rkG735EUqO1TvR yAmqOObp6VpV9G08hAEKclbdszQt1zirzvebe4Hua75Dyb5pU//ag47Y1U5SCz0ALyfiebTyasS uNiwtiR/cwZ8cOkc4FhrLjNAEi5VoxjwsnT0C5YxT2zxbN2s0J+6CrZHPZiRByAM7zc78KL//sW bRL3JWSpDS3B4aWGPCF9ex2nR2V9uNz9SbBGf7z4NYgcFmmndOZXRYeVq3het/FQB6jlTdS+IyU lgBG/h26i8pCS1QyZyxyDp0KB+9MLca6jTGzj8gYWUyas3dlNkwxqbCBgG20dBGKEcXMBvvmwZA == X-Received: by 2002:a17:90b:44:b0:3a4:acde:1e3b with SMTP id 98e67ed59e1d1-3ae896f8546mr7005266a91.13.1793560946060; Sun, 01 Nov 2026 11:22:26 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.249]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae6e973ac6sm16068213a91.11.2026.11.01.11.22.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:22:25 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 14/15] bpf, sockmap: Keep the rest of the cork after a redirect Date: Sun, 1 Nov 2026 19:20:56 +0000 Message-ID: <20261101192057.2296489-15-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov After bpf_msg_apply_bytes() a verdict can apply to a part of the message. Then tcp_bpf_send_verdict() sends this part and goes to more_data, and the sk_msg prog runs on the rest. The SK_REDIRECT branch does not go there if the message is the cork. It removes the cork from the psock before it releases the socket lock. After the redirect it frees the cork together with the rest. Thus the rest is lost, and sendmsg() reports it as sent. If bytes remain after the redirect, put the cork back into the psock. Then the prog runs on the rest, as after SK_PASS. If the new verdict is SK_DROP or the push fails, sendmsg() now returns a smaller value or the error. msg->cork_bytes keeps its value, thus the rest can stay in the cork. If the psock has a new cork after lock_sock(), the kernel still frees the rest. If the redirect of a cork fails, sendmsg() still returns success and frees it. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Signed-off-by: Alexei Starovoitov --- net/ipv4/tcp_bpf.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 9bdcbb0a5998..a9af6be2aadb 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -536,6 +536,14 @@ static int tcp_bpf_send_verdict(struct sock *sk, struc= t sk_psock *psock, if (!cork) *copied -=3D free; } + /* + * The verdict was for tosend bytes. The rest goes back, unless + * another thread made a new cork while the lock was released. + */ + if (cork && msg->sg.size && !psock->cork) { + psock->cork =3D msg; + cork =3D false; + } if (cork) { sk_msg_free(sk, msg); kfree(msg); --=20 2.55.0 From nobody Thu Nov 5 07:32:38 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.52 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793560953; b=i228HXl5uQeFWZc94e18DvSs/QqhSWxStdSgzi983mmFTTl8XQTwZBcU1uRUNw8/+NU0 hpxEzZokJYPWAoPpJsn+8XoY1eoDMj1e79dXffHp5i+A/22Br9d3kGjNS2P0lhL0Q/Y9I JdZpFXwp1dZmw3WcK4cSVQUO+dbg2PJP+qZ8U6VJ5jizgZZYcRR05v5JbBbFqL9b5DYG8 zr3KGfsd61oYrCR60rLZivzr8l8cKQCsGSYnf4IAVLCTWqNlrO7XziydD5KKiOZBlKGNG ZrwPaN9QAXMvoHHPnszrYAVrPeLjXytzsK1MJOgpPhHgYRH9C2LnxEXm6dm/52xGDXA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793560953; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=GRlJOwLDEqVYeEwYcHpzUEpdYNzizl6/DkuHhzPzoUQ=; b=nbVeAmqJSoz1gE3zJiVJ1ghAKVhbXz2VD2mhSp07oxfsQ0YD7zeAfe50M6Aes0PS1HpE 3c4Tmf2kHf2j8VrGqnUMKHErKX+6VzyPgOVfBLwF6Jwk3lsPq09ZZvoC+95LQu8LUhCLE VEXCv2cYcmZ57MPG+XIdmCiRIYuEErOTmTa/h9a5Mbon7jmH3im7+E4xgj53SB4B0p33z TSUsqXnIda1J5xBnhpTSO5kNOue/O+i4DQNppTd/4t6o3UZKN4HrNnrvWhtJv3JlbvNJa LtVLk3PN11ujlnLxxP6NdwnWk73S8gbVbB8f14jaVNnFnmGWYuPxnR5eBscCZToovag== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=oqTr3VbU; arc=none smtp.remote-ip=209.85.216.52 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D414660A2602 for ; Sun, 1 Nov 2026 19:22:32 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org D414660A2602 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=oqTr3VbU Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-3ae702d28c4so1007993a91.3 for ; Sun, 01 Nov 2026 11:22:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793560952; x=1794165752; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=GRlJOwLDEqVYeEwYcHpzUEpdYNzizl6/DkuHhzPzoUQ=; b=oqTr3VbUoMavTUJne5pjQPVruso/tucymwT9pjyBH8lapWuTsxz0tuWMGw7BJ7EDjp EWRqQ7G9gbLuAx7ZTh2Z7OyDZATivOUnz91WqD7kI0v5b1PNtjHnQ9DT6kGJxyIY5r9V H2clYUlsyHw2qvufvtGFODQkUJimvFX6WZWRLOry0osAEEdveecnY0T5OY6+1qjlH876 wxVyJNfM0ZO785HuN0RnUg/NTUkI7U5KwLNCIXVpxkiGyQNjgSV/ySpk6nQPRRTfhanV GLOmCFZeC5J9A3R7OsOjyPNXxxxUqdcfxUpQeeytaP8GVxo55uIOdYLCLO7aqYjKL4Di X+DQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793560952; x=1794165752; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=GRlJOwLDEqVYeEwYcHpzUEpdYNzizl6/DkuHhzPzoUQ=; b=lCgqNglDGSLWTHSaWCcG+Xqh/r3ek0znKQmpP1PCgkbdnJkmc/epWa+i8MYSTbR23M kX7Zn7HFhs+SvS4FHeqmb4FkBP/zCpVn2Pp+Je4lW37vHrZdIFIWqexBU0lYR76Ev37s EPNzDqAjAM1VVLYB7hXhSIZOd53WuBYIGfZTDQdwYxY/HlNRYXFLfp5+Su1HFtoI7S/h gCXipFHKkDw1al87JCuGYUbghUTHigXYbYpPYThRubSZPfee5mYSccJ9r/aOX570yY3P 3xBXqNCvbfdfaTQG+iSH5cLtvgq+2naZhr1zFOWg5eDONrqadck/ekW7+KEaEu7+uXmb 9znA== X-Forwarded-Encrypted: i=1; AKwUvByzxeZPypFJ8/x73q0GCi7rHfmqSV6vGjjPrfo66hDmqxjIJjT0qbyzk6PF8n96uaL90WJn/A==@lists.linux.dev X-Gm-Message-State: APuU4Z8k6lL7iuCrVeQzaHq4Sl/w5Dtoff04UWidNY5hIOWRBov8TiD0 ZHV7LM0EOEJMJb6AgfMB87S0+NfY/8ujWSoX4ohVHfuY1hxbBU2iLyYl X-Gm-Gg: AYBFou0XGMZVZ47ue74XmxlIYE/g3L4705eKzlFXwI58YPAXqQtgx5PL6JXaanwJ8MW Sv18qOTuOXJaW40kRSGFg9SUE4hQhwsqd7BnI5rsDSX+8UldD36pX5zVnZywz/F5Z/PmVmzSR8i VQOoirZ0a3yRKrAFVhzR7WvOy/KVz8jXXHkIqTvOmTYLVxxuZQePm4zUPUptQHlmjK4X3J2S2+9 9EXmUKqFH7YrGMExQdKybJUvFDA1QAgEJQOwy62YTUlVIWJ8U/i9LNtwvF5tcDfe+2qczh1q/7s iZ9nPgIE0uxExH+YeTXVSfTYbh70g/O7ernylBfMY1BNZGDe2GoZofcsCJbEAb4qCShrfIMKbap v4WnNXOJuvFL6iFxEcNUSb6g6W0bXzej49FLwGC52K+m4Vl4VA5qMqhl65SKrpDbSJlfJ5ht3tF OMPnobA/aseMv56ECj7bvyDoKzJ6yYN1xce13/LxpovIBtSH4o0A4UIOTDb11Rehmc+7mRce5Ti o/5uAE+oPsBSBwcyEvlRC3wlBP0xzVGv7qzqDLQB1OeWR8cpnNPo/UJGndY+b94OlK7Reva8P6k zB8PMwgJXSX/eJOF+nlQov4IorgjoBBPEflHD8Cs9UfS1dFpj3v9r/jmojLWM+zpuW2w4RtBFQQ EkSbhaKXltTB3MTNPn9uQ/1LGlGfNI/CB120zCsoe6EZnguQF/ArYmYaB862oyPBjDldixLGR7g == X-Received: by 2002:a17:90b:58e3:b0:3a8:545a:9e87 with SMTP id 98e67ed59e1d1-3ae897cc9f0mr6175910a91.15.1793560952122; Sun, 01 Nov 2026 11:22:32 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.255]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae6e9426ffsm15652012a91.7.2026.11.01.11.22.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 11:22:31 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf 15/15] bpf, sockmap: Clear the end mark of elements added by push and pop Date: Sun, 1 Nov 2026 19:20:57 +0000 Message-ID: <20261101192057.2296489-16-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> References: <20261101192057.2296489-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov The elements of an sk_msg are in a ring of scatterlist slots. A free slot can have the end mark, because sk_msg_init() marks the last slot of the ring. Also, sg_init_table() in tcp_bpf_push() marks each emptied slot. Thus sk_msg_alloc() and sk_msg_page_add() clear the mark of a new element. bpf_msg_push_data() and bpf_msg_pop_data() fill a free slot with sg_set_page(), which keeps the mark. Then the sk_msg can have an end mark before its last element. bpf_tcp_ingress() copies the mark. Since the commit below, __sk_msg_recvmsg() stops at the mark and frees the sk_msg. The data after the mark is lost, and its pages and memory charge leak. Clear the mark after the two sg_set_page() calls that can fill a free slot. A free slot keeps its mark, as today. tcp_bpf_push() does not read the mark, thus SK_PASS and egress redirect do not change. Fixes: 9974d37ea75f ("skmsg: Fix invalid last sg check in sk_msg_recvmsg()") Signed-off-by: Alexei Starovoitov --- net/core/filter.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/filter.c b/net/core/filter.c index e187e3c27999..d7b364e43b4f 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2995,6 +2995,8 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u= 32, start, msg->sg.size +=3D len; sk_msg_clear_elem_copy(msg, new); sg_set_page(&msg->sg.data[new], page, len + copy, 0); + /* A free slot can have the end mark */ + sg_unmark_end(&msg->sg.data[new]); if (rsge.length) { get_page(sg_page(&rsge)); sk_msg_iter_var_next(new); @@ -3128,6 +3130,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u3= 2, start, sg_set_page(nsge, sg_page(sge), b, sge->offset + pop + a); + sg_unmark_end(nsge); sk_msg_set_elem_copy(msg, i, sge_copy); } else { struct page *page, *orig; --=20 2.55.0