From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.52 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604084; b=CKneM2iEmipVrS+WvX9QrUl2g+QA0ZtGkvBl1mXkOVPGnfMwP1wSv4tk61sNRTBr7JIR zVBTtn2QYqfNNVSpKhCkT2NzR1B+OOyihtNaYZOB5Z3wm99rII61WsJFxOUjNW+WClx5H 6ThLHhKm1BpRpJOVvx0PVIEaD4AFyEQPjCPCYpxLewBc2Lc8Z7CPByrgt+nBYEQsmde/M ZOd32HNdhSh2VfXg55RcuX+7UWNoRq2oMInKKo4NLtR/XMESCmhyGbvdcdvHwNitIJZsz gPpxRji2r8hcGH6jBnuGVCqmqaexKbi9BP0a1EhwCQojLp+r7zw6Zi1tA5K/n7nsCeA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604084; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=DFLLbX6mAbQ0jCV7LiEZmOooBbXiKj6J/ISxTH/9yE0=; b=EN/O2ODtCgB9DgJt4vqUyK5CZiX+/c8FMduXcTwHJl9rp7WmUtvOprf2toz9emggIaaj AmerrD4gy4Q85VFjNb3NDqpKI7BXzwHa0hyxQChHzd+L+P1/Aza8nFKcRbzWlB8viTYfS SU8hv4D4tM2q5o7qOOx2vDIZO1K9atOJ5+3yqig00zugpAJrjfAFXzQQ2JxOFglgyAzOV pKKndRJX59HioMZHTSB3OubeAeojDOzkynJTfK8Z/JXwO5wUEPqXRJxn1xEyVoAYfEz7s igZ4FTkYHv/xylSFAVFCKXPyY6TbZQRooZUh9G2zNCDKVqucdspO2JpRSXkogJg5CXA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b="a/oGZgUD"; arc=none smtp.remote-ip=209.85.216.52 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 70C2C606A327 for ; Mon, 2 Nov 2026 07:21:24 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 70C2C606A327 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=a/oGZgUD Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-3ab752f6244so3226450a91.2 for ; Sun, 01 Nov 2026 23:21:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604084; x=1794208884; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DFLLbX6mAbQ0jCV7LiEZmOooBbXiKj6J/ISxTH/9yE0=; b=a/oGZgUDDaX1vCLkex90yv6+RU3mk5w96+80wA7Az4xyW7foAZ2B/gFIhHKxEWx5zf tbg0BuVrOBP1U8fWIow9Zyn2E6rQdhV3kw8h2VLw1lHwG+h2ZS7x5UqCHN4++hRSK+Za hRwEl8oY4e3hf/tBaNszWhg5I/HKQeqpD6Srkxi4X9C63fI4Tm3ftEOuKTZ3CnL/Sghq Dc6mD/m/x+OV/azGISMikERWOvUbFLPZ8d9gUQHdsLsI78GDzNFj+2m29NAs0YSqKWLj AnGLF/To8FwtalQv7EuiROjQ7DKCu4leBwgX6AYHMeVng+G605vAq2/4hzlhD8j7ILu4 YTcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604084; x=1794208884; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DFLLbX6mAbQ0jCV7LiEZmOooBbXiKj6J/ISxTH/9yE0=; b=vlM9MfxefDj5kg0iY0ykVx1+jA1XFWyqXf2OEFMls/Baan9zQTRdcnvohtB8dgbx8W zo9HbZrbWYSKIGp6MTc20fJG87ACwoBqJEdwKNJet2ZaR1wvlNZGkJxyBHQW6pCDS8/9 O1Sp2jIQ7RzMjmT1ZRJfJhJJxgYu3aY9h0n8TidFrARzNy8Y9gfCNgJwX2BYj//L24jK j1PQT+dQzpFpGkRSrYZTB4X7R3Fu2rOetahKOPv4LX2lNLQb+0M0k8DMurtsqsNsxni5 gQAW6rMLImPmiG6H85q/HhZCgXUNyHIDRBBzWdwwW+SMl+weUhBThcPiu9+iQB0P92T8 +TnQ== X-Forwarded-Encrypted: i=1; AKwUvByr3BP32F5GdZOTG3MgTa/EkCmVT8C9O6hDRvv3vDU8hwjwjmUBrCYpLOgxW2OZMbzZxmPPQA==@lists.linux.dev X-Gm-Message-State: APuU4Z9r+qQZEllVQpWEBCDGQJlh8mrP6xEBy7hukCAZj2jdyyYI+k/e Ey7KR1AO6AvO4olt3LAy0wtAGtrG1dVbsd4oOtadEeDptJyd20wvLc0S X-Gm-Gg: AYBFou1TwW/aW6LAGKQWabLXqe3GfGK6JJuVy2lPjT+8VFR3SRi7HDzspUX8a6Q0WE0 Dj2EhkxpXpHk+F4eutHdCAe1ni/163rbaETCKl8MmpyGSTJHTxjlN9aJa8a7mDCxcG0E60Oznyu g6t+VtXOw7ppqtvANS3NBpZis57d1DsKSnD8g1AX7RjWSGzuAkPbll3+8fey8a/dfXD4psosI8v K5mmwCNjYpzFVY501Ve6uHQKD5Y6CRhVRSMawGZo7utHkt3bhQbw+TID/ERe4WyL9sVGpC8bHwX tVfOfNgZgxkoUxAA1jbZtfD3n5dfDjxN14Fl1ak9uiTJth71bti45QKLfgy0HjFb+u79rACiuwV JDJDGXD25zIcM8mTCWR7KtoCv+8ijbl6Dr3shw2CsEEA8QpvT2TYc9JgppllLbLebx8w+elwSJF wbLKhxyU6Fns/OZeWv4hBp99agJcw1fd3xCSZkggfPHCe53QbqIntm+oxvpLp3SEo1XrztrRKFM aG6f1s5uYJzBH7CckfSPnbhYyq3jgTfT92PKeqmybhVctbCbtr5LLA6uKs/9bA+/newhcYQ/uZf qsiV3mAtCnXfR8QRZb4BTneZjgCEBao3GmWAFbQSaSvBg74AH0FYnIbJMs+M5gj3c0hEnyNfY/h 9XJc8f+RC8SdMGPP7pm4auHbye1B28mtHbPppCsF9HgHd/CDjUKh44Sn1FvVc7epKy8d9FwdHtp s= X-Received: by 2002:a17:90b:53ce:b0:3ad:6090:a190 with SMTP id 98e67ed59e1d1-3ae89817b01mr7725554a91.41.1793604083734; Sun, 01 Nov 2026 23:21:23 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.248]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae6e9426ffsm17877536a91.7.2026.11.01.23.21.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:21:23 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 01/15] bpf, sockmap: Write sg.start when recvmsg() faults Date: Mon, 2 Nov 2026 07:20:58 +0000 Message-ID: <20261102072112.4160195-2-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Josef Bacik __sk_msg_recvmsg() copies an sk_msg to the user buffer and starts at sg.start. After a full copy of an element it calls put_page(), unless an skb owns the page. It handles 0 copied bytes as a fault. It writes the new sg.start after the loop, but not when copy_page_to_iter() faults. element 0: length 0, put_page() 1: fault here 2: not copied sg.start ^ today ^ this patch Each subsequent call copies 0 bytes from element 0 and returns -EFAULT. The user cannot read the rest of the data. sk_msg_free() starts at sg.start too. It calls put_page() for element 0 again and can free a page in use. Write sg.start in the fault path too. The commit in the Fixes tag removed this write. Do not write it for MSG_PEEK, which changes no element. Fixes: c9c89dcd872e ("bpf, sockmap: Fix partial copy_page_to_iter so progre= ss can still be made") Signed-off-by: Josef Bacik Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- net/core/skmsg.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index df385a5a961e..f03519468ad1 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -443,6 +443,9 @@ int __sk_msg_recvmsg(struct sock *sk, struct sk_psock *= psock, struct msghdr *msg if (copy) copy =3D copy_page_to_iter(page, sge->offset, copy, iter); if (!copy) { + /* The elements in front of i are used up */ + if (!peek) + msg_rx->sg.start =3D i; copied =3D copied ? copied : -EFAULT; goto out; } --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.49 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604091; b=xcFxRM3Urw+eD91H9u4uAeGonECllHPquyVMifXaOUE6OIeNquWvEiKbdm/0AtpRLVBH yM8641Ow7ew8DwZZjD9ClqY1qsEgL2EoS9E40UNSK+dT9nH9UKsaklQ81tq8vYPciXCx5 jecLgLKLQ5ezGx0WMyxDM2xpQni5dQ1GTDMXxoDeX2gWZKNjz/+C3i7rg6T9/ozaiZgww 2dYzPFWEInboYqNobKuxLe49meXDpXSMjvOQQHK4A+LeLX7kAFw4VqWWhDBuD+Xn/8rC4 4gNqxahlZK53r4X4EyxKdV5gkWXd+lOOA7XmDFm2jtYhGt3PYXOBqxp8ZW9j6P+dpdw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604091; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=sdirJ0jP7o+YHEJCnK7VR6r1ybPNKkJjwR4pGDyhi74=; b=raT7S8CWeeCq3ywoxbOCxEVDdF4c6JvzwvMzUFS5dsv1srrMhD103yCXVKJgXTbfw6I/ NE/58G7pbBT7a+9YyKgg7Xj/K4vK8UlZS99i/WKRfi+U/PlmgxidHLm9mrsvysCIYlmSH Bnw+psCx8GhvVpU7eKyCjifs7hhZoTembry9g1BBvdJJoZ5P5nI2Z4BDFouK/f7IEMI3g fI/6JT7A6k7hG7ZuPZWcKAfd+lpWuprZOESgnAMX2zxNnS/xOLbsDsVkIWdLMj74s84RK wTaTLj+8AVuXkVnbJ1MhhM9RtAeyiXnHfIJBs5g07SzwDQredXdokLKf+IvV1F/wx+Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=NKATjFub; arc=none smtp.remote-ip=209.85.216.49 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0E59606A327 for ; Mon, 2 Nov 2026 07:21:30 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org C0E59606A327 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=NKATjFub Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-3adf5f6833cso1355120a91.0 for ; Sun, 01 Nov 2026 23:21:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604090; x=1794208890; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=sdirJ0jP7o+YHEJCnK7VR6r1ybPNKkJjwR4pGDyhi74=; b=NKATjFubBFyN/7hWIQkbnMW15vHfODdhCtSNwGEupl57OE1+CLnCJXyUs8SbMI/5NK sACB0H/mSO4eV42WulXt/+eVRUGTfr/1GbMek/Jib6TeOAwq6itsyJ2lNBITsUE6Ny1j nThKU5h9130XJOBD06np1v7L550uR6Ws8traHJ72YMIa9xnDV8JPgEw9C5IdQuQCfn4F Ynk1XzRbx5pDMDxAIM/EqcRfSuWzyHvpszePQ4werq+kDVPLTr8upHpTz5Ra8MN0U3SW jTe/ZED6yT+Ovdbc38St+Qu1XaSAKbzWmGLmTPh0rzL33PdLetALfXhF57V9QfhxYHoe OO+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604090; x=1794208890; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=sdirJ0jP7o+YHEJCnK7VR6r1ybPNKkJjwR4pGDyhi74=; b=PEamM4MREa/BdlQ+T1ezUB2859bhUUIPqBY8LAtDZNi/z73+y2XjoZ8VqM+XBdAvjH ZQmn2s3BgQ2CJptYamGb091aNB3ROvvD1ZHUx93C+RJZLcyc26yghvZYgUigR3kwNT32 u6Vf4fFQrb01YGMEd0wD9JhlpKsaAOjemgpZD+IGplFYRhzXu/OYOEvY3F6SpQHaNBdj ezZ1UFElE1qL7TaarssM8kGOnJxtlW8hgw5BZJXGg135gHsfUEGXLYBOloxYV9ZdnBQ1 q8Y9aJC+M9cgAAgnUmDZjKg3m6uXHrTBgnCiOzWuBoutl/QXx/NljO7WzXHc7FgLCB9R XuiQ== X-Forwarded-Encrypted: i=1; AKwUvBxZydbsjzI6YNanTHro/g2+fbwOa/PtR8TtleQgpyAKeUZCKUyD/bPHrudLse829CnKDGjyvg==@lists.linux.dev X-Gm-Message-State: APuU4Z/lMHOCM3QtNQhPUYYc7u5IaPVLXvWaf5IEiVyqR0sqWWAUwbPJ mX3m6cyJLT1Iz7m91v0+LPEK7wEIjOY0HAR1PtPXGTMSSq6VaaokbFmB X-Gm-Gg: AYBFou2FQkcq2rRjhaZlN14YaU0orxupFhRXlGgyHT1grzOiBNSbzijO8EibpgYS496 hlYTlQH/1w/Ng/BfqItkA8hHZGBZX0mEvZ24qTFw6vJc7c2s7UCsPQd8I0vOg8mcsedjioatEOJ fupLnU9PwxhupRxxP9WlvDR6MEytcZ6QmBHH0YVb26SWzwOssdnCdMDGsfo4AVUrKaH+HH+jEsk xHJ5bOzR04KBDYeuUnZMuhGDHdNhrgiRAFFD7DpsxvGq6Bxgy4eoqZ+O0wcsKQ/whsdnnLBuvri JrIQui950yc2nbQqCmp+BH8E4pyoOO0akTq4hwU3/2iu9aHDkrHh9AXvPgryWZG8BNNpWHr43WC Wo6ONDzBfCMXz+aETZCZ/mHvH02eiGkdD3cdegIr8Gs368n1O/6iV2YopMVIRnIW8V9XE0NkJuL QGD6G3CQ91QB8oM6eGcU1NMmUHBM75RaFj/YhVOGtFPEc0K0dPsInX5e5e5qFo6HADHXkMUMyj6 ltNiw1Z+iTfuBNmal+GEILwB5yhcGiy8Ycde1TSNV8rM8eSK1nK94ygpMIgI0/8uYp4IKlbfqww UlbCT8yt9jp+iURFLbFby9dnEGssxavKBazvgdOpXodNUGcwaG1JmV+pDevGQs2TjI16lO5RBkN b3DU8pEZyHeLjO1KeFKDr2AI8yeDRVsLk3fVyLxDw/rieaYUvFuXfijvOVZwqVCb1lkUZL/HOpA ET X-Received: by 2002:a17:90b:4b8a:b0:3ac:1c76:61c3 with SMTP id 98e67ed59e1d1-3ae8974656dmr6955366a91.27.1793604090070; Sun, 01 Nov 2026 23:21:30 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.246]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae6e7d5b8csm18000578a91.1.2026.11.01.23.21.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:21:29 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 02/15] bpf, sockmap: Don't let an SK_DROP verdict stick Date: Mon, 2 Nov 2026 07:20:59 +0000 Message-ID: <20261102072112.4160195-3-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Josef Bacik The verdict of an sk_msg prog is valid for one message, or for the bytes that bpf_msg_apply_bytes() requests. These bytes can come from many sendmsg() calls. Thus tcp_bpf_send_verdict() keeps the verdict in psock->eval and runs the prog only when psock->eval is __SK_NONE. The code that resets psock->eval is after the switch statement, but the __SK_DROP branch returns before that code. Then sendmsg() drops all subsequent messages with -EACCES and does not run the prog. Reset psock->eval when apply_bytes is 0, as the __SK_REDIRECT branch does. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Signed-off-by: Josef Bacik Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- net/ipv4/tcp_bpf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 8cf63a9e7fed..d90bcc911b36 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -509,6 +509,9 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct= sk_psock *psock, default: sk_msg_free(sk, msg); sk_msg_apply_bytes(psock, tosend); + /* The verdict holds for apply_bytes, not for ever */ + if (!psock->apply_bytes) + psock->eval =3D __SK_NONE; *copied -=3D (tosend + delta); return -EACCES; } --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.172 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604098; b=Xxx12U23yxWnE9xcltIfF4Pf9qttVOfTBCLrrn3hh8x0jgh1/BOjD51B/DrN9nyb5zuC FCl6spwKOasAUNlju3z/ubEghOw8J68eKJTgzBYbuyrjkd1k9OncoAMcNnFbYNqg/MQoJ 42F1YL8b7bKU3bFoUlPcCHx1xe7QrpMNFMRdSxzrNaS+H80S70pMp+ZAkEmQVetrz7bdu tlcKflYrDn1FYzA7w085diDINHMB9WbWMifGhSzVFBgl7uEPKml6uM8hpHDCgK5kxPVhj mBgoKtQ8UuNcF/wwOc8sTPNYZoE4y7MT4BHYUpWWHOMsOKbPxXpDY2eiwCZ/sVdQPtw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604098; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=Z7Peb9UAgZRQMeYI4B90l1wzrMCTNfd6vqfD72GCEUg=; b=krmUceM+8vGmDs4qW0HIZzQO6zYc2m20l5sV7SvNRfeMBXbEKrf5qer5M8cxRTyGbFfx 3WRbSXKHTEbmOsxxvBTsuNkYwRFoTLEAHkWYkIIXWikVzUpHxL1ONrZ5r6xGOw42m+Ddp dAdkd+7LfvI3Yv+kKNDSC2vOZFJ/2zJqH21Fj/Jh3vMNQsGC3IwtdalcGBOA6dEIl0HVp 9QtHijJgZk4UmPM580e+E5w4CR7e8VCxV/yh6SU02hCSt3ovwpvKMZVcfwfWGSzfTNuKn 2cSoLZwvHFk1giIWSTFNFUJOvgohJk30oVlNyilMfbKtYt4hTvlhS5gumnK2N4pcG6w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b="U/1gfTvB"; arc=none smtp.remote-ip=209.85.214.172 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 92924606A32E for ; Mon, 2 Nov 2026 07:21:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 92924606A32E Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=U/1gfTvB Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2e9eb579c0eso13386085ad.3 for ; Sun, 01 Nov 2026 23:21:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604097; x=1794208897; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Z7Peb9UAgZRQMeYI4B90l1wzrMCTNfd6vqfD72GCEUg=; b=U/1gfTvBvk+xzsniVOqlThNSsmmpLJv74/ndwTK9ijTO/4sEJ1oK9m1zMgWiPwRu8c 7fiuN6jNXBxBAmznPBb/Drtjm5iV4bQwd8DbzReMrb2MuhIbrtomcw9YQmOCKenk1vx3 n4OL/c30ugLDnXZgJ2FH5J11rsY6D4o/WCpikgr2TEESuF6ZU2jrdKVgO2ibnTBvDd7S aBNLTcT251sJff1B8pxzfu1vUtxY769RTkNgvDEGXWah22hg0YOwqx96RKWvPoJIe3Z9 9SvkpwTcNQ9YZfWA8M5NXBDuklqUaefoFsR6NQfQGbNzKo8dP3XN4Xa5RHxpoDKDIvq9 b3nA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604097; x=1794208897; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Z7Peb9UAgZRQMeYI4B90l1wzrMCTNfd6vqfD72GCEUg=; b=hpIZCRMQnXXTQqJHvJoCYqY5NBwquc3PFoVlJtwSInGfxipXFW1UXJ2dT/+Oq0ASqh djMQdu6XXsWsH7GEsAwlm4rsv3qyLwQchYhXg6vNyHxSiiOdodTNoskxtUlRUJwaC+j6 OmQZJ5DMJjSXmPf+DkAy2Hnl+vvW7TIYoLHSYX0wtsA2Mu5QvAMF4doc2bGvNElnxIMq tYGanlO2q88igZUP6QjWwzjmoVqlchvY/sbWt9n4b38mN5XG4FUMuK06eUadaOr5sFfo tw1w+6io0Be+S96tawxoqwYOs4BsOygg/1DRz+BWrALK2h2FPM7sDkkK/EoOXph/WJkH VD7A== X-Forwarded-Encrypted: i=1; AKwUvByNMzcZa3iXTddFKv6TdOU+VAUyNYHpjmDCAvMGt8a7rRq1TdBSIVJO9B0n4EmNsKOWT80dSw==@lists.linux.dev X-Gm-Message-State: APuU4Z+VZdYc42jeSibnAbYs+fQP9ycEOavgECAoTwdWcIkT09GbA/nM vHUErVqUJEA/EGCIM7JvLTKqtyP9SMIDyK07RUR8oRwKsonmYhBGt+Xo X-Gm-Gg: AYBFou1qdeVFSyNwS4q+OEiLOKTb8Xh+PbukdHUbwYkBSa1xmu06mic1tJKztzxOqcC ucDLfOzLdTa22wEQoZQfORAItiz2KoX7uNrqvpRzY/ZO+aAwMU4lKi/cyERzAF6BXK2lFQzlxZU BQ2drWe4+kAHrBwNBjl2buLf0FnTfXkVVvkINUTslGlMs6ksWxsxBzT4sgrJFptUyfRa0q6hAx/ OcxixpaltpP85o5IGOxUr6ty/kTTEXQF4E/ZC7pUzR2l8VAFc3eONn5A5ZBqySqn53/rPiFSEoF dL3PY9XKcFxLQk8r1gq/cCGuVph2meTY9A4NiNfg+3YopEkvFufjqp/OaSZ16nMFRi5U6beWAPX b3JTZ0dkKr0eiWtxCImrtQcvgEGjN+SpnZEHBxlIT5/+v8dA/XAbsHenNrxrxiNhEfwXCZvR60E 0L+3wWwRoMwXAKeqkGPIvpc/KyyoUcp60xQzNclS/vKwqCGUR/BcXBCo8P8ahocRBpX/wS/8YSN O05YaAsQkd0pPX+6O6CmtS+bcJYLhrYWKFpaZqz8DYmkV1RoX5bAg/Ghyr+IPTvIO559aLZ57WX fx0AU5OliuHDDIJxHm6fBlrvqaskrEYPu2hTuVciwy9sOyeSSCmBukkv9z9vc0of8F48yUBiO/v cVri5VWPZa20lIH84qjwyrjAbWJijjjJ0Xt5Y4tTS0AJx3DlEFAHQzjYU0ItctiJaaKQp0QNisn 4= X-Received: by 2002:a17:903:4b0e:b0:2e9:9a19:c54 with SMTP id d9443c01a7336-2eb3646ee38mr76369615ad.50.1793604096781; Sun, 01 Nov 2026 23:21:36 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.247]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2eb3924c858sm24478145ad.35.2026.11.01.23.21.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:21:35 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 03/15] bpf, sockmap: Don't let an SK_PASS verdict cover the next message Date: Mon, 2 Nov 2026 07:21:00 +0000 Message-ID: <20261102072112.4160195-4-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov tcp_bpf_send_verdict() keeps the verdict of the sk_msg prog in psock->eval and runs the prog only when eval is __SK_NONE. For __SK_PASS it resets eval only after tcp_bpf_push() returns 0. But the push can release the socket lock in sk_stream_wait_memory(), and it can fail. Then another tcp_bpf_sendmsg() sends its message and does not run the prog. With bpf_msg_apply_bytes() the verdict covers apply_bytes bytes. After a failed push, apply_bytes still includes the sent bytes. Thus the verdict covers more bytes than the prog requested. Reset eval before the push when apply_bytes is 0. If this push fails, the prog now runs for the rest of the message. The same already occurs when a message does not fit into one sk_msg. When the push fails, subtract the sent bytes from apply_bytes. When apply_bytes is not 0, eval stays __SK_PASS during the push, and the prog does not run for another message, as today. The verdict must still cover the bytes that a failed push does not send. But such a message also lowers apply_bytes. Thus, if apply_bytes is 0 after the subtraction, end the verdict, as after a push that returns 0. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: John Fastabend --- net/ipv4/tcp_bpf.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index d90bcc911b36..b016aa419fb2 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -457,8 +457,22 @@ static int tcp_bpf_send_verdict(struct sock *sk, struc= t sk_psock *psock, =20 switch (psock->eval) { case __SK_PASS: + /* The push may sleep without the socket lock, and it may fail */ + if (!psock->apply_bytes) + psock->eval =3D __SK_NONE; + origsize =3D msg->sg.size; ret =3D tcp_bpf_push(sk, msg, tosend, flags, true); if (unlikely(ret)) { + /* A part of it may have gone out */ + sk_msg_apply_bytes(psock, origsize - msg->sg.size); + /* Another sender can use up the rest during the push */ + if (!psock->apply_bytes) { + psock->eval =3D __SK_NONE; + if (psock->sk_redir) { + sock_put(psock->sk_redir); + psock->sk_redir =3D NULL; + } + } *copied -=3D sk_msg_free(sk, msg); break; } --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.169 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604104; b=qEhAzTz6e/Mh9tS6t8mlRFy/PAwDNmZqnJKBGoqOULnOkCQFavuqscHMxACEayajhM/7 laZFZzrrTqDQIs1JsTfTwZr1sMybyQ5zKusoxOTM4gUWWdG5RvD+LdYYeKrIFfwp2bfGA Tclb2OEU94+t936kZm3lrC+J1jdn2bzfcP7iOROxu/Gi6tAmQX+SEwoiMkrYNyWEYFFIR ArWxgZMo+ysuK7aNqagFt2cBCZw2mqCaALwHmX5IPIAQlIwcucT7SGuzIJLwOYb/mPNG5 zTX+Ep4GbrQvDdVfse7UMrO5PKh/bNhUOz4dCi/CaXDhNbIpb19L81bkirHAnEC3YxQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604104; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=Lw6EOCCC6sbUctDXo+tERpXOU4fD8zFY96sMocjjruQ=; b=MItQ9pWQlkw+N7s6OdSo2l5FvSu364hQTFyvaSXkW1E4PStQuRjo5maq64gWtqDFb/iJ XrqwBr8ZvDVAaPl/BflRMYjLj7P/pB1bArY9Dnhhstaszd3cmHyBlsMR/3TlLwNH+3Cvf bPxNFURBGWeYirEJJH2XyYM3/VMClcEotsJWpOMcNTEpbpshUgJ2CupItCt1WpwupyGnO qEVR7aYCB3AS7SIlmo+GwTBd8KikvhuVgyqJPEZx3+6kiy/VJKVEiY/DTgRzMjpzMCQ1y /TcC8VtLkIXMJMTVBfJ/tIOcWekBOkhRA+QMREqqq01cfTAk9LmnHCB9WJR+69KnrRg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=luIqRAt6; arc=none smtp.remote-ip=209.85.214.169 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A224F606A32C for ; Mon, 2 Nov 2026 07:21:43 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org A224F606A32C Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=luIqRAt6 Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2e987b4a710so19496315ad.1 for ; Sun, 01 Nov 2026 23:21:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604103; x=1794208903; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Lw6EOCCC6sbUctDXo+tERpXOU4fD8zFY96sMocjjruQ=; b=luIqRAt6IQRez7+ZRL+qzBM/7jLO9IKHB8d1exKPvOEQy+IUvuI0rmj+sdgtFus40x oHqPYQIrkJFT0dMwpP2KYp13JO8CnmZ7SPQguvy1GmqicALV9n6Xc1x+roIC5896ngOI nGJwehX5VhAlyhGmRVKPnMAsBSVMiBIgR05QbdseBz3UqKc+RdHD5EzWtmIiZ49e3cyO JJF5cz88iB/P7NlAbSwOVp9GWhs2JfpdypZhG1CLzqWHXX8LRCicoCvTSjkp2PjnW9uM 8APhU4LRUPz54nJAo5eqxavlSsFlrqefJDdYkDucnEdS/yVO88ej8/u6VHgn1tMQQ4D5 i/vg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604103; x=1794208903; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Lw6EOCCC6sbUctDXo+tERpXOU4fD8zFY96sMocjjruQ=; b=Bmgtgyw0wnSY0rmRcEx9fcgIEDNM8tAYWmuG6Iw4OZ2TncdLK8qtrWc6IYF84olGGO a9rXaSMkv6qub3nl2IrGnbXc2ns5Rtk0oKK5Umnr7DgQK5wmK0nD6p4e96Drbxrzr4cF Fv1u7L9Y+jMv4bfm6sQaMFNpIrucS8zVDQ2mMp+5qhCG3O3gT4LY3gu4srSAExCwTjK5 jDDbKX5/Nb0hyckwpcCaX3R25QHl5eREKVXvmh0hIr1iULAMxSq9TLSl6/9wy+1KdA57 HBuEPyPCPifYvvFc3SsFUVf4m/ZfDMisJkN1h5ifFh/wy/SQe8OqFHHPUojpB2NbPLLY M+ow== X-Forwarded-Encrypted: i=1; AKwUvBxIANAD/k63MvtzdSg6YRmI7ks4BvnHCA3R+RvTZicibyIjgkUg4lGQIh17lsiL8AATLqPnwA==@lists.linux.dev X-Gm-Message-State: APuU4Z+oweNJK/Hw8XdNqHNiYJ/R9D5pAljaCKtNHbEn3HvfcKxISVyZ 6MjtEVDFdSdzuwplG1HzDQdBb2X/f60I5gOMTd0NXv8gFE6jg2bVVoyM X-Gm-Gg: AYBFou1hJbIbYgrqPmjx6lsPihlafkXZVW5ugFkKe5rq7V0MDqu61JMMQNvDVhAmvs5 jtY6ZKWbDUiNInipAecirM7sJJcq2l1sUK2AtJx2fabPXuzGrWuVE1OdLvwHaU6rdFFYjTDurBl L8oJY5+W4ys3s2jvRq6YEElRO9VaH74KpgB/ERmfSelRSB61oWyoPEG9fMBwswbyYG4aK8mNHar 0xs1p9gobJnVVc04qfjWlTxMYZy2c5rQzL7+b5ZDkkczPjfb5Cz3swenJeb9WERF95g+Ut/6uHF fOc6OBptaE9wvHoJh4iRoGL+biIQ0QPe2LghjQwIHlaNuCwoGbVSSdNJxwAxtDyTyzcYMCcFCS3 nM5UK9jJ29cHB/PBwjptd4dR99c9sMk23NH4KwclLeorFLnxzQT5t4xZgXA7L3Pu0Aify7q4+43 DqiNTjOh/bCQOAyl3cK6YLYJX6B/1TxCKtrtrVh/cXofkiE9G7iUJbWtStcaurDzcVUDxzvQ8lp yqPL6TtlBvb9bwQRVp3o/PFwEZkS4xzr+uvHv+SUrU58kDODFI7Ixf5HLcRPPWvzWb+UwB+YtdH 8adCRUdRDkzIuYwGoX+qK5uke669ZZHSPx0h+GAr/pvezqNevP5FHly6HnoZ/vD2g/V8DlsFnbw TYSmEOvhjrBV+wQgFhHdMvsGYJBt9/Og9BLyJnNgH2lW2fJS6Ol7OPhCMonf3ANpKs/GOyo93kG 4= X-Received: by 2002:a17:90a:dfc7:b0:3ac:6e91:3f1f with SMTP id 98e67ed59e1d1-3ae6f00cccemr7838997a91.37.1793604103048; Sun, 01 Nov 2026 23:21:43 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.246]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdb09814cb9sm2753697a12.24.2026.11.01.23.21.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:21:42 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 04/15] bpf, sockmap: Subtract all dropped bytes from the return value Date: Mon, 2 Nov 2026 07:21:01 +0000 Message-ID: <20261102072112.4160195-5-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov When an sk_msg prog returns SK_DROP, tcp_bpf_send_verdict() frees the full message. It then subtracts tosend bytes from *copied, the return value of sendmsg(). But tosend is the number of bytes that the verdict applies to. After bpf_msg_apply_bytes() tosend can be less than the message size. Then sendmsg() reports dropped bytes as sent. Subtract the number of bytes that sk_msg_free() frees. After an error the SK_PASS branch already does this. The SK_REDIRECT branch does the same if the message is not the cork. Nothing changes when tosend is equal to the message size. Otherwise sendmsg() now returns -EACCES if it sends nothing. Fixes: ca70b8baf2bd ("tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sen= dmsg") Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- net/ipv4/tcp_bpf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index b016aa419fb2..36d1bf46353a 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -521,12 +521,12 @@ static int tcp_bpf_send_verdict(struct sock *sk, stru= ct sk_psock *psock, break; case __SK_DROP: default: - sk_msg_free(sk, msg); + /* All of it is thrown away, not only tosend bytes */ + *copied -=3D sk_msg_free(sk, msg) + delta; sk_msg_apply_bytes(psock, tosend); /* The verdict holds for apply_bytes, not for ever */ if (!psock->apply_bytes) psock->eval =3D __SK_NONE; - *copied -=3D (tosend + delta); return -EACCES; } =20 --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.173 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604111; b=Ch9l/wy70EXFQ09eac1s3rl+xKWyXnJP+tKIEWnTL4cdMTqDk2vIH/CzJ1B9X7R6uA5g PXJFtfv8NMGc8wg25b/ihoEJ2gNwNJTJp4mtj2ygi6ACKyeVe/uFS7r1/XlDFI4/Zh5RQ yZFpCD7MNr47fB3l0tRpHfwGHcXsfZ4WzZEaD1DirmgI9VBg+czXcdYXadl2qpB9yXVJL iRKFYFwmFabLUP0TGfkhz3mg2rzgxXDNTGHaEL7WbutkD+SjHz0phB8D/qGzksKyOxdJk 9BRuvG9DBjY2/BPE7fGSxClgIPScwbFuETMDBd77QDfu5Dusoc7YuvbKukBo9b9xIdw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604111; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=0ivwDO8RmSZboOluSZSZngxFUW4tZlFEXHx0gIyw2xc=; b=y+yH6wxWL+clOjHgtmBqOwoCz7FxQ+QJf0qri6VaIV+oirdOE2JTT98wF5rxpHstAkPT NPAvwPD9c1wI042kN3kt5W6/oiZ4Sxbs711u2K2DDOGU3qj0MzUS/En289cOhhtU3GgVL Ia99/BaAHfk5Ys02dPEn9zis33gmwEtLxGMnoYadzDgHNx7buB4MDXoOgE73XAPcOJUO+ FHT/iLtyVKOyxFAw04T1wlg8Cse+Oh279/wj5CVtbj7lgILSxpv5VA4Hy05xXg7MdlQIx BdgQPeQNCLeP6QiEKvd4lRxGG9bKO/84CdiOYBw+eP6KFqAp0JSHyKgS++daqy8URiw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=yW+PwhyJ; arc=none smtp.remote-ip=209.85.214.173 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D0194606A339 for ; Mon, 2 Nov 2026 07:21:50 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org D0194606A339 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=yW+PwhyJ Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2ea7987517aso17811445ad.0 for ; Sun, 01 Nov 2026 23:21:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604110; x=1794208910; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0ivwDO8RmSZboOluSZSZngxFUW4tZlFEXHx0gIyw2xc=; b=yW+PwhyJ2R0TcVW4owG8m1wKAFCx178GbRcK46L6rdWcVADxUVzAlFNrEM5q9TXIpQ 1RRqTw23uaYAskykgquNcKESYhpnBObdSkBGQKepi4VeCdixyqaZJnTLhIwsiIv489ba 8jy6JpjoAcS37EZE28ZCVcY/Nch5YMx99e/fZEiOjGYhspaWEk7IsAOGodBM6PcKOJ02 FfhIHNzaSQ6lw45BNEFWyh2KtASZJjw+dWPF+vh0tcHvEbOs6NzvKERvdsDV7uJ3zolA qvyYhGLJQXNv5SYYpA0U/pP+s0QQ/E/pa5aYTIoniobkpEblzVaf0pezcT4uEKcdVjhH eJGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604110; x=1794208910; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0ivwDO8RmSZboOluSZSZngxFUW4tZlFEXHx0gIyw2xc=; b=n37Sf32AcfrkzIrgd2/6nZ9WGALjOOji2i3417aLH+NxemitPQly+HOhyaHAObqnSN b+/Y9q/6B69XN6jGeCYprj0dGrA7h9rutA80+RqyKStV7nlz0qLZGkQoDY4ah8Lz0Qkf XqnGC/X1A/98og9YWQo7rL5hEgOFBiBk2gTgU6y/jUDoWuj4D0BqIuJtkUiKHZKDmkvq sAN7u6AtfeT4G4EcF4P/TXBLTBqQCxUvBcWZh0GRa7sGSeFDmuIi+vfrcI9YG4ZsRHQU yjYBTsNp6zrStRSZJXVxuUyRlSBM7lpo8etyee8SaDcP+s42cT85itOp89409WW8QHKM iOPg== X-Forwarded-Encrypted: i=1; AKwUvBwbd8NPkqXS3JpC+Fzan4PnYlKDckeSQW6uUgFa9131Si8ZlG3znVmSs4Vt5ojANY5JgPN5OQ==@lists.linux.dev X-Gm-Message-State: APuU4Z9r+g9RJLz7WEcywWqPFkhzX2FGmqiLcGDC/iWG8I06REiJtK/x hd9QMR4RAaI/jHBfYxxtJ5fpeCI6N+zpsmPaaxI0+nZXC1FB4owLgFJB X-Gm-Gg: AYBFou3F6WfteB+b3tq+BhPxu+5yiSktKbxg6v15PSWiUyyUskcb2MELUQaqV0cyBtg F3Nn9wkvkzpVpeytCDJjZgCDibN+oR867GuJUhvc/v+AyDCMX6zJNduzj4Njafg1SZkZHweuo38 Y39jTOQ3cKp/KSMkpGiP97rCLW8REgo+o2Z4KVudEAvFDn4pvgacyU3VzsvVJt4LviLX7gDVOlD cS7qjshPxv0WFs/kx53JZwFW5WuGaEaJPugmrJlJjwDB+YMxjf4o+RJ7+ige8ctC2AN0g9j7laU cGqVztuh8+qwC5ctVY3cD8gLuhLgSF2VsfNLbEpe12y5QrjPiTQI55u13BCmhqa3h014hW5noXA LO62dARV64mpA1OnHvx+3oN6UTRlvZL5OxNGVGGyGVQRdBriv0i/c6fQNsNrV2f8brWf7tswHZ/ ZKOXWKT8kSnRPvWyPXooWflMPemxqHw+ZUJR1E82uBSzy31BnLbQIBYMiPvjGtRPJOW0almgnbv bitaV6jtnL3Y39yPYo1deO5RxvArYrfSuMJ3ALj5GnbEWWyIKMXhkq+urMy403gbMsniVWQT8+F M2WlhSmNS0P3zqD3fDZXr5nVg7aMExkgztm+8K57yn5Mv8NuqdGWmVR58BmPbzjyKp/gDmP4J06 WkqFN7O9sCA+07MtsowrrSgZBVDqoWaZdpB9cjbbViyWYolZ+9YwuSnuPtg7Dy2RSjhMWxGkUhA == X-Received: by 2002:a17:902:fda7:b0:2e9:c569:7050 with SMTP id d9443c01a7336-2eb365116demr91088175ad.47.1793604109917; Sun, 01 Nov 2026 23:21:49 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.248]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2eb392ae546sm23619805ad.70.2026.11.01.23.21.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:21:48 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 05/15] bpf, sockmap: Clear the resume state of a stopped psock Date: Mon, 2 Nov 2026 07:21:02 +0000 Message-ID: <20261102072112.4160195-6-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Josef Bacik sk_psock_backlog() passes the skbs of psock->ingress_skb to the socket of the psock. When the socket has no room, the function saves the length and offset of the remaining data in psock->work_state. A later run continues at this offset and clears the state when the skb is complete. sk_psock_skb_state() saves and clears the state, but only while SK_PSOCK_TX_ENABLED is set. sk_psock_backlog() does not test this flag for each skb. If the socket closes during the loop, sk_psock_stop() clears the flag. The loop continues, but the state of the completed skb stays. The loop uses this state for all subsequent skbs and sends only part of their data. A closing socket may lose the end of a stream, but not the middle. The state belongs to the skb at the head of ingress_skb. Always clear the state when this skb is complete. A stopped psock still saves no new state. Fixes: 3b4f14b79428 ("bpf, sockmap: fix duplicated data transmission") Signed-off-by: Josef Bacik Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- net/core/skmsg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index f03519468ad1..a5d498982848 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -664,7 +664,8 @@ static void sk_psock_skb_state(struct sk_psock *psock, int len, int off) { spin_lock_bh(&psock->ingress_lock); - if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) { + /* No new state once the psock is stopped, but never keep an old one */ + if (!len || sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) { state->len =3D len; state->off =3D off; } --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.41 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604117; b=RK+sQjiNPBV7+q+4QrE2c8q03AXmGVUPrzExboWNF7a2n91lPtTDgc0KQwgcA6zlKVFj D3JrrooSgOENQ+/ExAyjguxibIs0PDWy1lYvc0CJKTiNctHGNO8lBLktVjAnHsQdVQ3q6 jCDlVvLa41jp7sLz0CODfJ+jKlh/g5HtWC2e9A/OYpef85DwejA/iAXLkoK8KDL5FSaEO eqCFIFNzy7HqS0itTevhNgXipNnMKpE8j8NU98pG8Cx0tHMgQ7wu+vzzDo6ZKtU58yK4T 7R8a5564aHIOuFr9Rzy72YT/tK2vDtmyDEhk5D3jTSylkIJh4EIUqTMMQ3lIXYD16yQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604117; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=DJmLVVVW+5deakG/rXx9rSWGIQrWi9+mRR7c5J3o35Y=; b=BuPJ4S5zj51RyDzFMHWCXMM3+Tirutrg3g+O2inUmCMEq1jWHhY0cVAF38DbgQx0Cfls fV8fLI+TdypBhc+1JmdXW4I1Ez09YcFyh1ELTZof0y812aUbNRXu5MV6X7K2qOETd2XqD AUGbj94I4wpDt6tNJ9ymVkrSNYidF/K0c3pj+CmU0pZNbtt08gU+ZJBsE/MjfWRaBlXM5 Tum9v7t0GGLNwG16NrL+MU1O+oK8YNfIDx19ZsN1HW3wdZQcMjF6Y4eTMWhRs9tfacHzk evAyIrEyfTCJtovaZJ8l3xP7+Rf/cE+bnmWprQikgiz1J1ggpB+WZA13sWsj0zTE5qg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=nOaCnmtn; arc=none smtp.remote-ip=209.85.216.41 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7C23C606A324 for ; Mon, 2 Nov 2026 07:21:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 7C23C606A324 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=nOaCnmtn Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-3ae57dc1ea9so1225383a91.2 for ; Sun, 01 Nov 2026 23:21:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604117; x=1794208917; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DJmLVVVW+5deakG/rXx9rSWGIQrWi9+mRR7c5J3o35Y=; b=nOaCnmtnRhvP8ztS2i1fiR2Ej1uUFb7CL6czQmUyBpWia+Mj12o7sfWZIfWTh3CtYV AsRbmkx9714BUd1ZhVSYmi+iD9wi6J9q9QnFkubpQ16V8J9UHj9R1srsAtPSF0fmBcXz iNJYMs60pxaGbKLIqYBZeArNTt8pBfEBFPOYBJ3cComFdmbwgMUpGgkTcdvX0w6p0gUx A+XcbZS9WtqaKf9SXJNmlu/KYwT0XQEX9trus0EHuyUrrLq6Ibur0f29jvPXIz4BOWU8 0aUsobDqNY+40+InPYn2ZSZlSeH0GPVnxfDmPnB1Yw9jlqp49n2mLLg1b7pjrrjVgw3f KzVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604117; x=1794208917; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DJmLVVVW+5deakG/rXx9rSWGIQrWi9+mRR7c5J3o35Y=; b=mTifbPbJykYTxeITsjfzG6xtXG/0liajyNfl5fRIXkjM+GYh1E2NRwIk6lIAzIgmJ2 0yK52E815bVs+BhrrUy2qUFgqflQJ5gduC6jROe+vhX4lpzgMP7ZYJy8KdxKDMfYngta Gdq08X6q1tj3pM1/fL6IfbcsRLsk8ZsY4sesK+zeEGTVFb+BR96l+nkS6zn6B7M+yr49 lnr6Ah1F10I+l76+nwsvpH2soLd+XzMvBiI/KD+Xr6E61KEu1V0HJO8YL7ennS4AACL5 YthMf/azWzBP8Xt/6pUy3Q4ZW+zPDUb5l05oUvauCSpmgAtaPAgtHNfERJkWTtgo0q5p buNw== X-Forwarded-Encrypted: i=1; AKwUvByjQDM4tNzv8tq5NDYA+o000ZAG0tm27HnDm8aXyXMyUrM5Y4W69snwFwxvaWNHTcYfXHfH2Q==@lists.linux.dev X-Gm-Message-State: APuU4Z+2cyDVU4gqjl6nUGt0CWJjTwoWVjlytKhve2/a5cgRs6db8OrM Ar0g4OSgzC6cu0S3tpuXS/cGddOZpMJmReqZ+0+IwTwyw94FToExKiez X-Gm-Gg: AYBFou3dWOsVSPE03xRGZshw+VRIxmmxV88xmNjsLdEudKmkm7JJli6KzUq/ijXRi1R EOXmT9w3GSfudUKi+DTySHj61NEpOARHYl35qrrK5mdffaOzuuWMG7vcm03XmFVXDibspvmttFm gvkX3ClbIMa42Zs+zUJvSns5q2h+S9uzEyqtct+NYTfkOtDeCI9WMy1kLL0zENfMJiwAS1vgbe2 ioJJ+Ks3QtrDm69Tl434C01BhNM3C97XZbvDQFFJuamgKx1J13rHi9MNuhcOBusu/GeecneP9lW 9plcflqIsjxnRGHonk++TK/mMW6TiuZor8jtr4xJVy/5SjEg5ofVulsfCUta1w0pBEo+JgS6dFq GtZZ8DdsKJJvcoEl/jgiA9j5BNly5cc7TSLxpmdkaEItDmnqo/YX0xf1NPCXMyrY9Sz5RmzbFl0 Gz0pwkxV3syBb433v1Bxnx+1Lk1G4S7AJI7aU07cyGoFY0mXHNF7ca8jHdDVTgARlTF0s/q1jNn /OxJ3IVX5BP1mGzVDg0ywnL8BCrtjow8+dFAd2Qdyug4aOB0JZoAIGBkEOFSZtK6muy1aWBHwhS JqL/UEj03ypxm/kkTiK5S66/z3+xJneyJl8A+VExeMKcFtw861dAJavnInsfohrpvjzpJWSYyqe 2ZWofv3UnDDx7sQ2+UOUxuoxlKRJ+ITxnetQ2QPdHNP1gpd4U8QQBOM4Oi4fF/0Sf2cMH5HErk3 g= X-Received: by 2002:a17:90b:184f:b0:3ac:83c1:2c0 with SMTP id 98e67ed59e1d1-3ae897e06efmr7231700a91.64.1793604116645; Sun, 01 Nov 2026 23:21:56 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.254]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae8826a769sm6098801a91.4.2026.11.01.23.21.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:21:55 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 06/15] bpf, sockmap: Give no progs to a TCP listener Date: Mon, 2 Nov 2026 07:21:03 +0000 Message-ID: <20261102072112.4160195-7-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Chris Mason A psock with a verdict prog replaces sk_data_ready and sk_write_space of its socket. It saves the old callbacks, and the new callbacks call them. sock_map_link() does this to a TCP listener too. Its new sk_data_ready cannot read and does not call the old one. Thus it does not wake accept(). sk_clone() copies the new callbacks to each child, but not the psock. tcp_bpf_clone() restores only sk_prot. Without a psock the child loses data or does not wake its reader. If it gets a psock, the psock saves the copies as the old callbacks. Then sk_psock_verdict_data_ready() calls itself until the stack overflows. sk_psock_write_space() calls itself too, without end. Give no progs to a TCP listener, as before the first commit below. A listener receives and sends no data. It stays in the map and keeps its own callbacks. Add this exception to map_sockmap.rst. A listener no longer gets -EBUSY from a second map with progs of the same kind. Since the second commit below, a socket keeps its psock when TCP unhashes it. sock_map_link() does not see the state that the socket gets later. Do not depend on TCP to keep such a socket out of TCP_LISTEN. Set both callbacks in tcp_bpf_clone() to the TCP defaults. Fixes: 0c48eefae712 ("sock_map: Lift socket state restriction for datagram = sockets") Fixes: b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap u= sage") Signed-off-by: Chris Mason Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: John Fastabend --- Documentation/bpf/map_sockmap.rst | 4 +++- net/core/sock_map.c | 9 +++++++++ net/ipv4/tcp_bpf.c | 15 +++++++++++++-- 3 files changed, 25 insertions(+), 3 deletions(-) diff --git a/Documentation/bpf/map_sockmap.rst b/Documentation/bpf/map_sock= map.rst index 2d630686a00b..eb466b86df17 100644 --- a/Documentation/bpf/map_sockmap.rst +++ b/Documentation/bpf/map_sockmap.rst @@ -33,7 +33,9 @@ of ``__SK_DROP``, ``__SK_PASS``, or ``__SK_REDIRECT``. =20 When a socket is inserted into one of these maps, its socket callbacks are replaced and a ``struct sk_psock`` is attached to it. Additionally, this -``sk_psock`` inherits the programs that are attached to the map. +``sk_psock`` inherits the programs that are attached to the map. A TCP lis= tener +is an exception. It gets a ``struct sk_psock``, but it keeps its callbacks= and +inherits no programs. =20 A sock object may be in multiple maps, but can only inherit a single parse or verdict program. If adding a sock object to a map would result diff --git a/net/core/sock_map.c b/net/core/sock_map.c index efe49551caba..282c6a4b2b05 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -228,6 +228,14 @@ static int sock_map_link(struct bpf_map *map, struct s= ock *sk) struct sk_psock *psock; int ret; =20 + /* + * A listener receives no data. With the callbacks of a verdict program + * or a parser it would no longer wake accept(), and its children would + * copy them. + */ + if (sk_is_tcp(sk) && sk->sk_state =3D=3D TCP_LISTEN) + goto no_progs; + stream_verdict =3D READ_ONCE(progs->stream_verdict); if (stream_verdict) { stream_verdict =3D bpf_prog_inc_not_zero(stream_verdict); @@ -262,6 +270,7 @@ static int sock_map_link(struct bpf_map *map, struct so= ck *sk) } } =20 +no_progs: psock =3D sock_map_psock_get_checked(sk); if (IS_ERR(psock)) { ret =3D PTR_ERR(psock); diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 36d1bf46353a..fd443350f9b8 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -785,7 +785,18 @@ void tcp_bpf_clone(const struct sock *sk, struct sock = *newsk) { struct proto *prot =3D newsk->sk_prot; =20 - if (is_insidevar(prot, tcp_bpf_prots)) - newsk->sk_prot =3D sk->sk_prot_creator; + if (!is_insidevar(prot, tcp_bpf_prots)) + return; + + newsk->sk_prot =3D sk->sk_prot_creator; + /* + * sock_map_link() gives a listener no programs, but a socket which got + * them in another state and listens now has the psock's sk_data_ready + * and sk_write_space, and sock_copy() has copied them. + * sk_psock_init() refuses a socket that has sk_user_data or a ULP, so + * what the psock replaced were the defaults of a TCP socket. + */ + newsk->sk_data_ready =3D sock_def_readable; + newsk->sk_write_space =3D sk_stream_write_space; } #endif /* CONFIG_BPF_SYSCALL */ --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.215.174 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604124; b=2Dcx4LIjJZeBhIwMBi2UDfBgkJ1nGwC7HsgfOMd+SN9Ljik7wv27678QwhDYhTytm6KP KJq9UoLdC7KQ6YUuJOnwH+Iyyoy136Ya3dtM9xKy6Grv66n9cfs0wszqYhMbJ7WkLheme 4+Dba2EgaRtFjwy5K2+wZubAseiubl6LJud1SnPPMm0urVNdB4NAZ/2Zgf6dLs6PSzB6H RMHyZ3qG/PwoZGukSdo2FQyWOeNUqGoPbDRPizcC+V5cxfWkd49ckZIqkM3BMMnfGI3OB UOcfcjvTL7RkJZCKDrLe4ZAO2YBfNv97x9TUpt23GDteNhVENj4nl+ZvgVaIxxRyBHQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604124; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=D4eYPuLg3xUyB1bWOTJ4iSiQffpGBEZKMs2NiPHXGTk=; b=GSHIIOHkK6qV7yPEG9EG8Wi/ZHzHb0C8i2dnGPn1zvbPa89qt3vhF3jH2cWecXHKhFQ5 tFsJBIKi2OFWO1fCptUugAVpm2jPo2J+H+DMt09aVwLaxi3zT0xKF5k2gUw7/B0NJ5nT5 Q8KfhOYEGY7iLbLMlWTanjLFeIS2wk72polQ1iW+FpuFOSCTyauu1EqLVkhSl83zaIayX 5BPZkYK9Vzg1x3hSClFCmHPiD+pjBZGFnuI/zlb+OMzhmm5RHqzoEgoWyUyKAGZDHlZd9 FuXsIjF8eBgH3dSacSbE8e3zq3AEXCJZKWAS0CxCG+iOGHLJrnixv239YY/loChXtdQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=V1nmTk64; arc=none smtp.remote-ip=209.85.215.174 Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5B53606A329 for ; Mon, 2 Nov 2026 07:22:03 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org A5B53606A329 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=V1nmTk64 Received: by mail-pg1-f174.google.com with SMTP id 41be03b00d2f7-ccca948203aso841273a12.3 for ; Sun, 01 Nov 2026 23:22:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604123; x=1794208923; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=D4eYPuLg3xUyB1bWOTJ4iSiQffpGBEZKMs2NiPHXGTk=; b=V1nmTk64x7E80ef6qU1GdhNn9wBQt8VWlcpQ0GTSbFrYDwu5ZSIPhaUrdvaoW76R1F 6hcdaEOV75Sgs/yIXgft+RNmZ3tKViMnUWk+vgsgsYOeyv0hk+KGHaGagX6KAAkvn1mh YmEtLwCIsBZxA02ajznZf/dtu9BdS0iFpmAisoTC300xf7J+CktU2LLaHs1iRRNrtaSX 2gU39NRPM8nTt+e5wM+spajzLP1RfVpwXdbZQ7v6Nx7ddM1u1QCmf4XdD6JWotfsFemD X8ti3YiFiwX75J2uXeKorkVAdiKWcYT53C8M8dII+J9KYamOPALYqKBEi0zsi+E8bnpm 06TQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604123; x=1794208923; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=D4eYPuLg3xUyB1bWOTJ4iSiQffpGBEZKMs2NiPHXGTk=; b=kh4T5F5SZOpEiioao+xnCLL7xo+kMvqXv79mLv0dC6Ojre0rRZ7031Vtmm6/5WvsAO sUD1gvJZ8gHRenXmVh9m0oz7iz+wtKLtVfF7F6Ut837se6H5QlHlJ8CZyszB6+6N4oTV Viqo7uv4ibvRRNSTQSI1N/PCUm3snEfBw2qH5g3V223pUmRm2aOtWjm5clzK+TJQTXQ1 BiUPIN57VHm6Pb0XqW+DWIn/fGu+f3TOw1NQ4gUQjmfsf+Q74/RaC0yxZKyT27xaNMux PyhyJbzKUo8rURT7yU83RuYF0vX1BGRldPLlsus7WW00y0qPtfbg5SplnQVqqfBWZFCg BElA== X-Forwarded-Encrypted: i=1; AKwUvBzwiGVhfT0NJkwpWiGyfCAbHNLuoZperv8vF5nYPg5hIcYlazl7DdXumSufv5G2AeUmvJo/YQ==@lists.linux.dev X-Gm-Message-State: APuU4Z8ENCy60ASwd7GTVrU9PEYmJJLX/MsAMSLYqIiVR+3KYQRtiyC6 ewIZkxIN++8npEgkY9OeJHygRkb+amik3rABhxlZDadOkI/4NCssaJ7/ X-Gm-Gg: AYBFou2L3F30YYcuwKAic/Ska7QVzoh41dZTTUIAu2LUmCOiZmqa+hos6QJ4+pZi7Cf 84EYK/83M8AAvE9secqj9mdg2Uhl8ME2AewkEx1aFomVYNBDpHyEabgwallKKMlv1MOnEytVHkE JjEkKH1OZvWL/2e02/BXw0azmPlYoyJTlrrzr73z/qiTFq01X1lf9Ubqhs+mCLl7ExpL5v6L8El KOY7Zw3a1Bp1+44isiK2JBdTNNsMFV1WoTWtOp+5zC6uweLLtsKPccozfgmWsxA4pUFZtTFIlqv qfR2iWETzecRnUl0FC5kyXykmLI+z4k2POcqpE9SKTTj5uyGUH827QbSelbmwJHiaDF3IYcfLNo +bB+3kFabB89H7lNIGNX2Nurrr2PplzAvfYgE9E3fRw7ZX7dtKvshI7bV8KNTexpo2rMCvbcEQz n800FBd3DuExEjdxZUReTfwTFJ67BNsIKTqNJGfkXuiOLgM2fnCx8CEPd9FYDjDtd+WjUxPyWZK 3NymtGnS6rcfnYDiE8Yp8TeJrou3px6YqEkUtTI/jaiQcGlpfwi4+ydYP6U7INCmuNBKsaj1PA9 cc/r6gqnVV9FRTPrXExOPYJDCCl8F1MT7UvkTEVgbd3gR+0yr51GHkBywz3tZzFaK12VjTVPshL v53x7an4Fpxi5RBHeMSccriCmTyLm60xs47j2s+jQELdnyBh10PKOxFbBziSiH/pOGZpeq/Y7a1 Y= X-Received: by 2002:a17:90b:4f42:b0:3ac:a521:953 with SMTP id 98e67ed59e1d1-3ae897c777fmr7064360a91.46.1793604122783; Sun, 01 Nov 2026 23:22:02 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.246]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae6e944ba9sm17487309a91.8.2026.11.01.23.22.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:22:02 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 07/15] bpf, sockmap: Check the target of an egress redirect before each send Date: Mon, 2 Nov 2026 07:21:04 +0000 Message-ID: <20261102072112.4160195-8-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Chris Mason tcp_sendmsg_locked() expects a caller that has the socket open. It uses sk->sk_socket and the wait queue sk->sk_wq. For an egress redirect of an sk_msg prog the sender calls it on the target without a reference to the target's file. Both pointers are NULL before accept() and after close(). close() can occur while the sender sleeps. Then the kernel crashes. Fail the redirect when the target has no struct socket, or when the sender has to wait for the connection. The error is EINVAL. After close() it is EPIPE, as today. sk_stream_wait_connect() calls remove_wait_queue() without a test of SOCK_DEAD. sk_stream_wait_memory() has this test, but it can still use sk_wq after the sleep. This patch does not change that. The target can change while the sender sleeps there. Thus do both checks before each call of tcp_sendmsg_locked(). Clear MSG_FASTOPEN, so that the sender does not call the connect code of the target, which uses both pointers. Today the sender can send before accept() and waits in SYN_SENT. send() with MSG_FASTOPEN sends the data. Today it fails with EISCONN. When the redirect of a cork fails, send() returns success and the kernel drops the data, as today. The Fixes tags are for the two checks and for MSG_FASTOPEN, in this order. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Fixes: b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap u= sage") Fixes: c5c37af6ecad ("tcp: Convert do_tcp_sendpages() to use MSG_SPLICE_PAG= ES") Signed-off-by: Chris Mason Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- net/ipv4/tcp_bpf.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index fd443350f9b8..ef2e15de0fe3 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -88,6 +88,24 @@ static int bpf_tcp_ingress(struct sock *sk, struct sk_ps= ock *psock, return ret; } =20 +/* + * The target of a redirect belongs to somebody else. A child that nobody = has + * accepted yet, and an orphan, have no struct socket and no wait queue. + * tcp_sendmsg_locked() needs both. See sendmsg_locked() in skbuff.c. + * The sender holds no reference to the file of the target, which can be c= losed + * whenever tcp_sendmsg_locked() sleeps. sk_stream_wait_connect() and + * inet_wait_for_connect() go back to the wait queue when they wake up, so= the + * sender must not wait for a connect. + */ +static bool tcp_bpf_redir_allowed(const struct sock *sk) +{ + if (!sk->sk_socket) + return false; + if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) + return tcp_passive_fastopen(sk); + return true; +} + static int tcp_bpf_push(struct sock *sk, struct sk_msg *msg, u32 apply_byt= es, int flags, bool uncharge) { @@ -109,6 +127,10 @@ static int tcp_bpf_push(struct sock *sk, struct sk_msg= *msg, u32 apply_bytes, page =3D sg_page(sge); =20 retry: + /* Only a redirect sends data which is not charged to sk */ + if (!uncharge && unlikely(!tcp_bpf_redir_allowed(sk))) + return sock_flag(sk, SOCK_DEAD) ? -EPIPE : -EINVAL; + msghdr.msg_flags =3D flags | MSG_SPLICE_PAGES; has_tx_ulp =3D tls_sw_has_ctx_tx(sk); if (has_tx_ulp) @@ -555,7 +577,7 @@ static int tcp_bpf_sendmsg(struct sock *sk, struct msgh= dr *msg, size_t size) int flags; =20 /* Don't let internal flags through */ - flags =3D (msg->msg_flags & ~MSG_SENDPAGE_DECRYPTED); + flags =3D (msg->msg_flags & ~(MSG_SENDPAGE_DECRYPTED | MSG_FASTOPEN)); flags |=3D MSG_NO_SHARED_FRAGS; =20 psock =3D sk_psock_get(sk); --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.215.181 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604130; b=MrKMnzhEdHL1AzWnoU6mnTxEXGFjtKM1q/AET6rDOgBHPOM2blXk+uLB84XOxPiEFbXY 53k5VZv6ZDNkmC2XO4ajvmQq/lucp0Jr/44QddVvsZ8L/BQtaP+AD7IUgQ2vdSX8aKBck auqG671pFGc0Eh8kqiR+FyUdyy1rxoYk+3PGm/PqCjfhiOxPzKnb/KIw7bL/2w8buQG7s ocn2PqqSo6ZmO5FAeWeYLS08zDEdRzDwjTIcuX/GCl3okkcG9jPy3PpFIvai3rNVrRlhT aNhPn39FQqz9siE85ToEc52DkzqIoKKrJwvhsIOgxIjGWHVPbEpOxNk1flKNBNodAsw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604130; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=q/uS3MNfywD3Vv+T8KYvUL+u5aHeTIkmuMrEypBwwRc=; b=1SNd7vJXRPpsaRimJOK/EmGBcRImENpKsCZJjvpwJJdafrJ9+92rJzz5YdDcacBDbz63 DuPzeJwRJha7wGKCRBCNpXrnqec9fUNUvTVc08ulmR8TYMB4Q05TP9HoEC+/Xh13siCIN fk9avmeUfjmMu1ZpS3DH6wOYhmvPLnB3HM8kjU2GR+d2LW/HLdWq5oRwIWxhHotEd5TIc CwmZPdZ0aQGQ2ooZz4RAlrozJUg9XHcfPvGi4YVw3x63CS8xlLbtLTuSBgGsa15K6srUJ 1Es8I9MkagU7v0EOJz+fKffiVG5EXaLain7eagkSHOSalDMo/Lvk2855fSPavZIkpUw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=pMlpKmmS; arc=none smtp.remote-ip=209.85.215.181 Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BCFDA606A326 for ; Mon, 2 Nov 2026 07:22:09 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org BCFDA606A326 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=pMlpKmmS Received: by mail-pg1-f181.google.com with SMTP id 41be03b00d2f7-cdaefe02d5dso1423722a12.1 for ; Sun, 01 Nov 2026 23:22:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604129; x=1794208929; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=q/uS3MNfywD3Vv+T8KYvUL+u5aHeTIkmuMrEypBwwRc=; b=pMlpKmmSF5P3kUgsB1jgUZIvVfmiWcEVE8McKweTc/d0xxbOPl0eHZnTS23Zgkw7bX OCt+AhcZNRGSrQpug7sJBgtnZhREDgo4uDPZWfY2KWIGLD3bhnt1POOV6fGpxkdlHPbN fAHMbjU46erzJZ9SeopMmTfM5sADdlc9ur8T9ZtURuuDugcsulpB3xJ24gwnGgT2S0iq ZTQrnjJ1Y1s1GzezbCFqfk7T1+pgGwtTBfEXILyg7tF3oQicNht4QfgT930KsJvlkUVV +5FJzwtr5Uc6bglrEJnlXI1BOQjHYH5pkx+Z5LBpvk+Yx/HRA4mcF+dNcGnrgYZwt2TF jmcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604129; x=1794208929; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=q/uS3MNfywD3Vv+T8KYvUL+u5aHeTIkmuMrEypBwwRc=; b=giKIhfR75PnM47bi2NZfVrr0VeMjIxwozJJFffsNalpQuEC03hXPLCrwNutp0GrgIh YeuQIV0VdlqqipfOvTFLEwfwT3IfT7G8ZEKfuZQneVk+fSB1jpYxMgCVHbvn3twf9oAT Ejtj7InebaWOBQrDp67p+lMvvgdlynsloPmzTQY6sqvlRoHWykQnnuuY8B0mMTQu+xrK NFx+aw+w9FHpyS8YRpyfsVrunJWtvTPWTKYb2jf3wSsd7Xc7ZnFOX974EGdrjCVlLutG BJqhVS0vNfVgCOCRuaMhChtqc+E3Zckz/EKYeRLNIiJug0mfiddwTZutQtGWKM9TPrXS nFYA== X-Forwarded-Encrypted: i=1; AKwUvByR2TCGPBONzECmkxz4pNJpgLX+xLLY4F03S9ZNxQ5yqrKInt7nbnl0DMEZA9k3e8F5mOCJSg==@lists.linux.dev X-Gm-Message-State: APuU4Z93mrb2C9GNo0bnNyHnKthZIabt9UUS72TVCPtoKor8zvx4Pdsr nxm5BQ17Itg3sK5uiQM4FpWrfkxFOP1ddc3IdeF3vd8k77pB3ICzNaD+ X-Gm-Gg: AYBFou29Pn2eAvE1vvXT0WxvsK2R9d53TZKkYBTOChVvTbA23ushoyQxp1OtvO7L+bf E/TamHxuvqLsm7uS1dFbzqZfsk0tMJPDKM3kqkTmMlmKFpUqog2G1PweG4ywBxFSygRqK7JKiMm 33+ZYH/bX9VP+KiUcvDB7M+pdNLLvnPV8HIsZaBlDWXNwnNUUq4dtl659P57NMP4Www8flw93Z8 5ZrWDI3Ds8DlG0CA/MhDG/uOA4+gJRMIey4CrK5B2lkWLLqaHi8osgeQmRjpVfIkqWzGU/k7F32 EjhMPiCZrjrqdIDC1orYTT6bKjHYPpLg+8C0sXLMAiV4TnsprdP4P5hMMSaUbJyiI23buP4ZhIQ Btivg900t+nh3/AZ+2sUmQtrU6VUXYjZMDt6T9Ih5ZfFBofUJaNHM1X5ZJ+JCZGBut6bWT98b+W A8YHl0pkNlZk5ZT3OD/bEKKCyW9GezNJkBCqNRJWxM/hldnVIAVzPzDaH+gtqEMCWUTRDorrl8m plVA9/7FmeI0ullk1JL7rd4srh9cjEFE3+YPePPIbTXYmZpJBzn3hXWcIhMqCz1er4E1njedQ7T 39kGcTjHcrJXN0Pcxn/JNqmsjtZYTEOjC6B1EcHzV7IFCosJFMxsAi3caom8/H7axEoosbXZaM1 HdoU8PkCmC5sRw28bNOq0ki7S2m2CZMn3sj8QEL74qXwir0RaiW4RdyKhHNoiCaDjTP/4T/Zhs1 k= X-Received: by 2002:a17:90b:53c7:b0:3a4:77b8:1770 with SMTP id 98e67ed59e1d1-3ae897c7747mr7453233a91.15.1793604129139; Sun, 01 Nov 2026 23:22:09 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.247]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae845ae5b9sm13043295a91.12.2026.11.01.23.22.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:22:08 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 08/15] net: Leave sk_stream_wait_memory() once the socket is dead Date: Mon, 2 Nov 2026 07:21:05 +0000 Message-ID: <20261102072112.4160195-9-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov When an sk_msg prog redirects data to the egress of another socket, the sender calls tcp_sendmsg_locked() on that socket. The sender holds a reference to the sock, but not to its file. Thus __tcp_close() can call sock_orphan() while the sender sleeps in sk_stream_wait_memory(). sock_orphan() sets SOCK_DEAD and sets sk_wq to NULL. After the sleep the loop continues and does not test SOCK_DEAD. The subsequent sk_set_bit() can dereference the NULL sk_wq. The tests of sk_err and sk_shutdown do not always stop the sender. sock_error() clears sk_err, and __tcp_close() can call tcp_disconnect(), which clears sk_shutdown. The sender then adds data to the write queue of the dead socket, and inet_sock_destruct() warns. Leave the loop with -EPIPE when the socket is dead after the sleep. The function already tests SOCK_DEAD before remove_wait_queue() for the same reason. A caller that has the socket open never sees SOCK_DEAD. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- net/core/stream.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/core/stream.c b/net/core/stream.c index cb255e2a3a5d..334124d683a7 100644 --- a/net/core/stream.c +++ b/net/core/stream.c @@ -150,7 +150,11 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo= _p) (sk_stream_memory_free(sk) && !vm_wait), &wait); sk->sk_write_pending--; - if (ret < 0) + /* + * A sender which sockmap has redirected to sk does not keep it + * open. A dead socket has no sk_wq. + */ + if (ret < 0 || sock_flag(sk, SOCK_DEAD)) goto do_error; =20 if (vm_wait) { --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.215.182 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604137; b=Cu7tr1yVQYrTrIkNWRzKYHCpjVnfv8jQW/eFfAk8Gm0rWELpR6a+3QOv9AjQySwvBxfc LHwpp9JvLx2aDkKBQW4ghshQvbRFgRRHXSF/2W4kOXcyJLuejmZHNlyzMOJbiEvh2g5Zh 6IHmDVWfleTeRNyILV7AAlPZaK+CvOzISQufBPpqUAh1o1Ln8ZSohgQToqXZIo6Dqq/fd l8At4J+UGXtf9NiRpt+HcyG3JHryWwNlTN+C0R1Mbd/CZeQ0bF9CyTK53xvbXnkrL70Ur m8eYK+5BoZ1358dGiNQi/BEywRnwjoRg1V3V09c1RhFDNCHWoP7VD2RbT/XvGUZTiOw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604137; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=IIVQCChPoYZLHDZpOQjjkNqmaU+lbodlGj9e9gYxfdo=; b=wbkpRUn1Ir+1PYvgotqvbiOe40Ov9wyP7m3xBySTU/BjWzYForbWCudvJVRSgEb1o6gB qMRbuDrrxjcBbBVndZaXX/sdZxQ6b+Y1S00W27TjBotN561hLe9/3iCsGWsu5Y77BYPRs b9TEWWrcOYUDJOKVZ3VFScdjfICweikzc9q1KxYxgJd3apRIsbDGhrX8JBBskt9d4gwk4 WKMcCNvUKYg6dvCM4YWdfvIyTAgpYuVAoV6h1KMPDZpjbnDxbtY55d6bj7uDZXHJndtJc tQxWDIWbngkI8+F/OkqJga84AefZaL7V0HWWsJQwo9dmqOdJI4iR3pyOj0+tJ5R7Vng== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b="gCH/rFkZ"; arc=none smtp.remote-ip=209.85.215.182 Received: from mail-pg1-f182.google.com (mail-pg1-f182.google.com [209.85.215.182]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA7E2606A32D for ; Mon, 2 Nov 2026 07:22:16 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org AA7E2606A32D Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=gCH/rFkZ Received: by mail-pg1-f182.google.com with SMTP id 41be03b00d2f7-cc1bc88a20eso1818252a12.3 for ; Sun, 01 Nov 2026 23:22:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604136; x=1794208936; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=IIVQCChPoYZLHDZpOQjjkNqmaU+lbodlGj9e9gYxfdo=; b=gCH/rFkZuHQ/6/aC4NJCvj0DzWhcWjYJab3ad5vUiWZZTqHRS2CBTr2l4jCVjIoUjO SMHoMZNJuMExg/OxEtjoHPD3KDuwihPM1pnoC21gV2h7jYmiMnRrOGKnITI2PXKwfWZy OusO1w0L3i8IaVLa6xTCx2pKNuOBJOumLPPquue84aTAueoJF+eZfAJjNqiH06ZmKD/X gG61vkOfAf8WsZaGOFVD5JxIpnDLM5YX+i9ED9TRhotWmMccgS6W7RlEZbAaw7QZDvIE L/pkUf9EaDTTdBp3PEA3tLQh+co5fqtb2hDkbMuHd4q0s7lkYbltkb+X0mavXCdUVd14 4Ijw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604136; x=1794208936; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=IIVQCChPoYZLHDZpOQjjkNqmaU+lbodlGj9e9gYxfdo=; b=wVo6iaP4E5L3lrrYfdh8L/K5q70s1FpDobxpZ0/+wk57FfPcfDCEXScAt3Leg9pRuk QnW6ELe6UqjmmEX23LYiyQMz3DUGw1k10gGHFbF4oWj6XsOJ+ZjK9x5WmWW5cFNcLCf6 qXmKZ3tcjgJ5IGF9KuSA33lZEjPqqkMDPMQ6WGbB+GSCgfdvXwK/zQlLF76sr7TePRIf owxlt+fgcJaGRVUqGkA8Fi/zFf3ti+o0hu4TrJFd9lxPRGYvxanI2Rbhug8j1Jo262FM BRg+NQX8gol3AgAVyhZ4t2abrNfhlb7baqqLZlSOIFBiPweeP4wpw5APEj/+JMfs55Hb XvbA== X-Forwarded-Encrypted: i=1; AKwUvBxOsb0cbLLUW3LlfZl+SrRg038kiXnVHrMQVv98wK4dScUg450YxoDZ6Nu/wweROKN+Cw/nSQ==@lists.linux.dev X-Gm-Message-State: AFq9FYJg1z3GPwDqLBV+mIqVmwJskOkVVm+Du3xTCJhn3AwyaSbsJjCI QeGF1ceu6c5gDMtDzdXNpTx8tSUoENxmU4M9h9mMRU7vecxI7lB3n+xM X-Gm-Gg: AYBFou0zE7NjyI9IlW6EJRpkAj2pjiSqeaaIREEEIkZrFyurMY2+1esNgfpCuknI+Fz LDecLqbIUcuQhxC1OGOpYp1E6eevnzP35eiLTiMWFbpqCmkYEJNxNaPtG10JGCcFRkizZ5ksMoJ 4k79BsjDU3XLaaEgYik0dz3XWmrRuotAqHwXxi43GqkoWIAYb4mnnuXFbArvkVHrFNz7LwD+uW6 tlWRdnPzs00WPPAweatsxzBZjx6PKeZeKjrUPJQmnMYxqk/fRdBocFd/JlIysSl1CpT5bil6gFG OAWQ3CUYUT1WBnlxxE+1xzXjRtx0eLwE8HDDDAaeee2TUnMgRya/kxIZiyj5CuwalCbb6FNep1D inOZoejdTbhzU4Ae8mUWzFcsUo9yWlXsmegEobCXBhFrzlxjvXfjSgypQ7V/JoXTPqe2gUp9o0B 5UxjwS6/mEVNpqhnGvTfvyKLvXCAUtDCJb9BjsR47OFfefXKXGgA3SN3PiwUPWm0xBu09Y0oCQP 5i5f7FOW1gfvtxHWDLyKS+dfChkEP+MmsxxNaIrychgeUrID+/TubFDMVZ0WDg/RE7YKy39y1NK akLZPMjS8Ql2VkbzAYY9aJ1nMImwvvKpjcdokCaIe+8ckHJMvcnw/a2AH2h3o+3B9bU0+EihRzu v7JjlPLl7CMmQfqQkNAiS2QxquzucdCntRUspUSydUbLZLbd+1IE6gEeS9XrNDYGhFGoEze1KwQ == X-Received: by 2002:a05:6300:6bcf:10b0:3eb:6198:7068 with SMTP id adf61e73a8af0-3eb61987343mr628123637.17.1793604135777; Sun, 01 Nov 2026 23:22:15 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.240]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdb096d3827sm2894741a12.12.2026.11.01.23.22.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:22:15 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 09/15] bpf, sockmap: Check the TCP state in recvmsg() Date: Mon, 2 Nov 2026 07:21:06 +0000 Message-ID: <20261102072112.4160195-10-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Chris Mason With an sk_skb verdict prog, tcp_bpf_recvmsg_parser() copies data from the psock. Then it calls __tcp_cleanup_rbuf() to calculate the receive window and to send an ACK. The window and the ACK need a connection on the socket. But tcp_disconnect() keeps the socket in the sockmap and the data on the psock. For a TCP socket sock_map_redirect_allowed() rejects only TCP_LISTEN. Thus the psock can also get data after tcp_disconnect(). __tcp_select_window() divides by icsk_ack.rcv_mss, which can be 0 in TCP_CLOSE. In TCP_SYN_SENT the new peer can get an ACK with the sequence numbers of the old connection. Call __tcp_cleanup_rbuf() only when tcp_can_send_ack() returns true. recvmsg() returns the data as before. Move tcp_can_send_ack() from MPTCP to tcp.h. It also returns false for a fastopen child in TCP_SYN_RECV. From its peer the child has only the SYN data, and the SYN-ACK acknowledges it. Fixes: e5c6de5fa025 ("bpf, sockmap: Incorrectly handling copied_seq") Signed-off-by: Chris Mason Signed-off-by: Alexei Starovoitov Acked-by: Matthieu Baerts (NGI0) Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- include/net/tcp.h | 6 ++++++ net/ipv4/tcp_bpf.c | 3 ++- net/mptcp/protocol.c | 6 ------ 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index 3560adddf821..23a22d70718e 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1845,6 +1845,12 @@ static inline void tcp_adjust_rcv_ssthresh(struct so= ck *sk) void tcp_cleanup_rbuf(struct sock *sk, int copied); void __tcp_cleanup_rbuf(struct sock *sk, int copied); =20 +/* Is the socket in a state in which TCP may send an ACK? */ +static inline bool tcp_can_send_ack(const struct sock *sk) +{ + return !((1 << inet_sk_state_load(sk)) & + (TCPF_SYN_SENT | TCPF_SYN_RECV | TCPF_TIME_WAIT | TCPF_CLOSE | TCP= F_LISTEN)); +} =20 /* We provision sk_rcvbuf around 200% of sk_rcvlowat. * If 87.5 % (7/8) of the space has been consumed, we want to override diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index ef2e15de0fe3..3d703f1517d8 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -343,7 +343,8 @@ static int tcp_bpf_recvmsg_parser(struct sock *sk, if (!peek) WRITE_ONCE(tcp->copied_seq, seq); tcp_rcv_space_adjust(sk); - if (copied > 0) + /* Data on the psock outlives the connection that it came in on */ + if (copied > 0 && tcp_can_send_ack(sk)) __tcp_cleanup_rbuf(sk, copied); =20 unlock: diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 7a22e9388e0e..d62cfbf2d490 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -619,12 +619,6 @@ static void mptcp_set_timeout(struct sock *sk) __mptcp_set_timeout(sk, tout); } =20 -static inline bool tcp_can_send_ack(const struct sock *ssk) -{ - return !((1 << inet_sk_state_load(ssk)) & - (TCPF_SYN_SENT | TCPF_SYN_RECV | TCPF_TIME_WAIT | TCPF_CLOSE | TCP= F_LISTEN)); -} - void __mptcp_subflow_send_ack(struct sock *ssk) { if (tcp_can_send_ack(ssk)) --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.215.173 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604144; b=UoS0zT8vTm0ZKjSonPhtc6xM/A8Q6OUV1FMMmWi1q1AdugBIu9e/K4NDSEA0Qx3VuNJP c3HPu1ET7JmUjxOmHG8+kryeMdm0puJBS2KSXDoIj4b0jDPp0gbzTXDWccdHZEgCY/ETP 5FaU1x6hy2OH6CQTT/7iXKMAGmOzcDqY4y2PSVPz5w2VBCuKRoz0dzbyE7hzoLIS5Gnbj jKBhVh7J6423q3Bj65uqSdjFJYKiyCl8aPXoDHp/wRZo8WlVlZUkfex8g8nG2VwwU09If o5prpT9I97uVj3gEiawWKPL4g/qEsaOWIQbs/8MFRnEI1eDI2qnaqbbB7Dhr6JbnPgw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604144; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=iBcyIy0xL+PHZYTiuLv6mXl5Ptne15lxX+AY37+XXm4=; b=5Mjr1v8leg3Yu13L0EhmdeRPr4ZmKTMnYtgjth63TS0OTqfYqb7fPqx4JzuUc0VrAoP8 6RJ+PAX2CCHB2uEGRDmJyThfWsSyI3a7sGo15Fo0BZdoo1XFS+KGuBY4NeJ+UQf4/Qw0x zLTyFXxV7JZXfY1l/WFLYv2BKlDZOn8B4bH7jJWXk7pzFOwrWGqrUGWhNMp8Ws5YZIXa2 LYAoo1QcxWsv2aJNzhsA884Qr6BpH0qfudLRhxEIAsFOW6lTIO3DeWt7vRvBE3JR7shdU 1QMVGiYIf2nDk66kaXmV8yfJc7mcFVYfKWDhdW7c/qiv+FFLpJwz1uAPz1sZe9loDyA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=a2+SRlUb; arc=none smtp.remote-ip=209.85.215.173 Received: from mail-pg1-f173.google.com (mail-pg1-f173.google.com [209.85.215.173]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 250F3606A32E for ; Mon, 2 Nov 2026 07:22:23 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 250F3606A32E Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=a2+SRlUb Received: by mail-pg1-f173.google.com with SMTP id 41be03b00d2f7-cdadf7e248aso899138a12.3 for ; Sun, 01 Nov 2026 23:22:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604142; x=1794208942; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=iBcyIy0xL+PHZYTiuLv6mXl5Ptne15lxX+AY37+XXm4=; b=a2+SRlUb+5whVAK/wd8ccxbWbcF0S/QRlySpZ54c3SylznO8tOO/esvzEt9oi7K82a 3n3+YKMZcgE7t+147Uce08nKyglMV2REyQrAb4ImLQtm7JhqMv8vD+wc4hBpxpvU2xDG W9zdsNVVPpobCQXhy7gCVpr0TqFbg/CA4YAvOxds5la+2A6Zo82eASvwvH7YoekbAqwq hVPXlEPNrxrExW0Mzsvez4k74gaFjZXbG/6THRSFWrVg0BTou/KPeZe3HCWwz1nQq6qY xHcORfBcFq+L2rCOD5YyD5K0SVv7G03eI3JGoV2o8TgXS9xn4/do6gW5QN3nOHC0+NaP UyyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604142; x=1794208942; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=iBcyIy0xL+PHZYTiuLv6mXl5Ptne15lxX+AY37+XXm4=; b=d7Gr85mW3P3C74GU5pVIhQCNr34wYAlMFA/ABsxdkU1isWhwSPNFrAY20dBQSlmNd9 2JiM6rIBLuqoJUXM4uUB+tRCgRF5IL2bYgH7wPv1xF9+eAVK3rQ2yfSRU1v9FJw3bxjo MfKyLzuFV/6rf6gxSDZzmaJ0+xR+T1U6EWRGboC/yi9Y75U+pnE/CzH/uXOSSkhcl1nm m4ZsAjSPxtSQs8Q69IZaCo7WIlg4+rHHZrIV75ectRlnMcH/TMw/z5f2LrY3ulxu+vT5 w3hdIPdAhhBySmnic/nYZgVMu8DQUsc/nUsBh/hJ3ikUndMSiZPVrtU0LYkRpFjkb0k+ D9ZQ== X-Forwarded-Encrypted: i=1; AKwUvByAt3Gi4e1gRORKuMgUjuzNMPfi8qDRjD4sepggJXISOg6MhJWjQUTWKcFaDMse0YiWOJkOnQ==@lists.linux.dev X-Gm-Message-State: AFq9FYKbeXU5V6UjeTcFMaBHbDnZ4bKbWpNLODj6/nMZ4x3fRnceW2WO /Q8x/1iGwtedMvelb5a/4FwTmtGMgaHELvcW2vxgdJy5Oq3GNTdSmWbG X-Gm-Gg: AYBFou2OfWbZ3ngW+X2qE+2jpZH3P3TDjUzju86zah3tR8KkV20SeuUi9TOdlzBTQ8c 0U2gHW4JiZPKyM8N6ydpjZ20RO5jiPzS8Ltocb/IfnDvPMEe/2JH7v5QR0ORJ1P3Jb0ZDXfBwIx 92/7iZG4LPV7gcZA18iOUHjKNmdP/X3DgzLtiffRflqCikFq95gNO8ehYGWJwoQcoRgQ1bsb2Sr PpzEUGqjd4mHl9XM4T4/MNvsvy16mfTQrHPi/vQa5NImP9ttHohfgrMAaIzzlWSwrkfCZmNHuZ2 6NExkjNzNbzYzgGPhUYuWeKBNx++5Aa7X6DL1TCJxrnX73OWDK1CkiVTbiD7NfFX8I9a+xiFi+C kfYbqyGu9cQuNLnqYV7hTLYrfHEdpAybt1m9Gb8fKCtH/XoLRfL6zuKixyeKSdfmi7X0G6BSGSg UxHVDGO4K1acbvEyxrCcLrdmB1M6tsAEkC/w3XmEg1f1vm/HYukgZLkSNMZTMbXM9Y1ApFPwPJF Dg86sXfOMg8I5nwpvRIh/IZ0Dqfk+prXpjH7tbAxP1fWJLR2efgk+GUH5jUODl7CqtJUrnRNxoV p8UZFxnlkzhQ89uiDro6HIFpWt1fEbNX/YvdplWuH6JMonNNnkmrCzpluE3eEIbguv6ahdD3ja8 JgTVe6rIOtyZPsvq4KiwpW4Knprria5dXNMYjxuTjwZr7EVoHNejiEhg59vAVQM/w/JvwQ/H7nw == X-Received: by 2002:a05:6a21:1644:b0:3e2:4350:152c with SMTP id adf61e73a8af0-3e928b8ad69mr8141975637.4.1793604142251; Sun, 01 Nov 2026 23:22:22 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.252]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdb096b4bcdsm2756194a12.5.2026.11.01.23.22.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:22:21 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 10/15] bpf, sockmap: Reset the copy position when corking Date: Mon, 2 Nov 2026 07:21:07 +0000 Message-ID: <20261102072112.4160195-11-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Chris Mason sk_msg_memcopy_from_iter() writes to the copy position: byte sg.copybreak after the offset of element sg.curr. Both tcp_bpf_push() and sk_msg_xfer() remove bytes from the front of an element. They increase its offset, but they do not change sg.copybreak when the element is sg.curr. tcp_bpf_send_verdict() can send a part of a message and keep the rest as the cork. tcp_bpf_sendmsg() appends new data to it. If sk_msg_alloc() then extends element sg.curr, the peer can get memory that nobody wrote: old offset offset end of data offset + sg.copybreak | removed | rest | not written | new data Move sk_msg_reset_curr() from filter.c to skmsg.h. Call it when a message becomes the cork, as the helpers that change a message do. It sets the copy position to the end of the data. Without removed bytes it changes nothing. Fixes: 91843d540a13 ("bpf: sockmap, add msg_cork_bytes() helper") Signed-off-by: Chris Mason Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- include/linux/skmsg.h | 19 +++++++++++++++++++ net/core/filter.c | 14 -------------- net/ipv4/tcp_bpf.c | 5 +++++ 3 files changed, 24 insertions(+), 14 deletions(-) diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h index d5e35f24738d..f0e27b4b929f 100644 --- a/include/linux/skmsg.h +++ b/include/linux/skmsg.h @@ -196,6 +196,25 @@ static inline void sk_msg_init(struct sk_msg *msg) sg_init_marker(msg->sg.data, NR_MSG_FRAG_IDS); } =20 +/* + * sk_msg_memcopy_from_iter() writes to byte sg.copybreak of element sg.cu= rr, + * counted from the offset of that element. Point both past the last byte = of + * the message, after something other than a copy has changed its elements. + */ +static inline void sk_msg_reset_curr(struct sk_msg *msg) +{ + if (!msg->sg.size) { + msg->sg.curr =3D msg->sg.start; + msg->sg.copybreak =3D 0; + } else { + u32 i =3D msg->sg.end; + + sk_msg_iter_var_prev(i); + msg->sg.curr =3D i; + msg->sg.copybreak =3D msg->sg.data[i].length; + } +} + static inline void sk_msg_xfer(struct sk_msg *dst, struct sk_msg *src, int which, u32 size) { diff --git a/net/core/filter.c b/net/core/filter.c index 9245009d9f1e..50c0cda778db 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2677,20 +2677,6 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg,= u32, bytes) return 0; } =20 -static void sk_msg_reset_curr(struct sk_msg *msg) -{ - if (!msg->sg.size) { - msg->sg.curr =3D msg->sg.start; - msg->sg.copybreak =3D 0; - } else { - u32 i =3D msg->sg.end; - - sk_msg_iter_var_prev(i); - msg->sg.curr =3D i; - msg->sg.copybreak =3D msg->sg.data[i].length; - } -} - static bool sk_msg_elem_is_copy(const struct sk_msg *msg, u32 i) { return test_bit(i, msg->sg.copy); diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 3d703f1517d8..d534974c33f8 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -469,6 +469,11 @@ static int tcp_bpf_send_verdict(struct sock *sk, struc= t sk_psock *psock, return -ENOMEM; } } + /* + * A push or a redirect may have taken bytes off the front of + * element sg.curr. The next sendmsg() appends to the cork. + */ + sk_msg_reset_curr(msg); memcpy(psock->cork, msg, sizeof(*msg)); return 0; } --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.210.174 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604150; b=PvK/rRPkrSU8az8P28F73vBSvG+GZN6oO3+KLsicOpwai+DB+9ggCmTcZjBhFRznnkTa 0OuRgHI5Teaak3vqgEn9tNGiMH3foU4rAPRewESLpkQ76OkgeVpZLyLj8HvO/F7kDau+L QvPU+4zgKg84/M3cv9P7GjR0RXjTunaxpH3frBeCAhkscbjHGB4x6HXj4HAJMuko2rwt7 Cjl0+QjOkOjKP/KQelFvZ7URfcwtryhMRikmG7U31Y64q51c9NwSM6FkURrr+2Zjrk87i kdMhcUsSu0R+yUmJDgfoSZQMlXa1h2sghXcJ0ovxIWMDad69SoxVXi7/IxglM3sHcQA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604150; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=9Zt7GQo7rKWxtj60oDqSl5MgB+Al+Ojst9KtoXZQtmY=; b=cA2dW3S1ZFRa/bVlo0oML0zCpI7Tbjn7I4HMPExCrhzpd0fVOxZj6JA7zoNbxi2+k/+E 3yu04SpS9SZjbXWFLdkKiiSROqUMjPyhVgT4mOCkx7wtTpRFGIvQ4yO6ef6Cu1KxAVRHX jO+8yizHioAwLdLByJ2Iv//ZT+aNdSBboH56axiTmeuz8IYhdYZweASD+YO3SDPzbAGgE qqAr/W14pdx/jMnfhwmPrBdw1E9S/02CxwjBQDzQ12yS3FLoq6VItwFGHUlgBDhOcTotO CCXFnJWJ+QiOACPK8BQT10oQdFc7uDptEfJBgovI9H+Dl9jiSo78R9dMgw0/t3mXq8w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=nRSsmU1o; arc=none smtp.remote-ip=209.85.210.174 Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E9444606A332 for ; Mon, 2 Nov 2026 07:22:29 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org E9444606A332 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=nRSsmU1o Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-8a05b210703so877343b3a.0 for ; Sun, 01 Nov 2026 23:22:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604149; x=1794208949; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=9Zt7GQo7rKWxtj60oDqSl5MgB+Al+Ojst9KtoXZQtmY=; b=nRSsmU1obkqFEl8/bSLdojExRZ/cdP8CMu+QHv+/JOjhKF4693Ud8jPPD0TPThmuGN +/6ijwzjViIttxNpENYCnqig6Kia/PrBPF9AJNFuAGPRL4TC3gykwz+Pys5+NzZkdHAg mWZLowgYwPOYhzSoOXGQWX6/L6fvtyGfBy8cgkzc6R3QvDTfTh4/5VyqNYx0K5P5WgNR /e0OFMYR5IKL2oclCK9u+kf9T+UzxIMF55XGaLgNDzFngFGAzuDwPIpnRRCPnQzBQs0K Smg6bTTZYPbkmZoZhMwUMmwo8QHnCpzj6swMEsM6OsjpOb9u3aH8Dip5EyOkd7tH+aix CfEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604149; x=1794208949; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=9Zt7GQo7rKWxtj60oDqSl5MgB+Al+Ojst9KtoXZQtmY=; b=ne1DhypK/9B59kmhPgn7fG11sNY4xN1nJ3h+r9Ehoht2r7xJzk/XPue5ZsnKBoz3Bm xmnsPrWa0X5WtgvlXlY63lxWhhB1iYn4IIqAOVsqt72JWE2UagSQlg2t9f0etFOD5pK1 ux0F6ehaZ6dcwyXWsypm1YkJAJHDk/1ehQa4fqyhHq/3jtt0Cm8WwI/4GVqVU5lUsv+d TKkOfkQrIcR3sFnUl2qxi+kSZe23W8j+hfwbdNqW1OD6o/XoCPVJlbOjV4IxU3MBXGNd TLdNs01GU4kot9+uuu3GTt7VUqu1n9KqJPcGmrAMkbia4pCEQiMUxTzC2kyonwq5EzGc Ye6Q== X-Forwarded-Encrypted: i=1; AKwUvBycdFgQJhMuZxaIMKE2/ovsIcZXfKXtNNNEUTfKWL+LSXf8tQavnRiQO74vsPnwySBz8vxpYg==@lists.linux.dev X-Gm-Message-State: APuU4Z9FkjkWeoqlV3aKOP6geD2JGK5EzKnje02gmBBUv2+TFETALGCG c7tMiFzCUKKlNdbXCR9wdpULau4Pi/B4JNYuFkTZZYlCsPkXvwrhpXWV X-Gm-Gg: AYBFou2jB60fFD4hsrzcCRr6TLdP1R31Vm9GZdDNX0cxPWluiCKA2MusbBPmjTWCBn5 cuGSDr8NOzBlqG5rzl7NIJl84S0ma4nsIRKZycS3VJCaz7qYODd/GDD7rKqORux3oV/GW9lLmrI ZBOzuzlPK2l1SfBwToaBtnLPCmQ4qW4DsD4eThTvrEbLuJfgzNKMbm2WBsxVGESUnrbKo9KOeTY dklh6UxAUsi0RJE8RGYhoxQvAciSlybVjaVF5XqgqedKfVkhkjuvWr8TGg7nfg5QimfDIzG7Qv8 PjIW+2zWOTDb5kaDNS9hZbR/sA2+Pb7d+TuWm9Ordo5COGl78O9Ln6/Fel3tjP5TGBWK0RcQFAs c0GpuxSUOhN3LaRIxAUzT3TXOlaI1krphMexdH/Ri7BkRX0O5/XQhNl8MparFHkmLPI4BME6rFx TEQHybhMEU/a4SeQHzNJ3DLAhpB9IFnOyEXyK3j64ZfXssLI8IkAh8WnWN6S5/Xchx+XKVQcwc9 kLGk4ISfnEJtbf5tk9PcqPA/biG91ilFOujFg6LChh8AsUZ6m3Mm94jnHEWpWGQ/xGmTRPF3ZXb Fg0o4ufktw1ULYLKjgOB37gbIBDY8jtzMUurnti3cHzEBVrBa6X1jdeC0nsTemQpRNMZ5u2OIma IWhoLSNN/IQIpzia1rf7gXizowG3N0g0WEgCP5axftIAfTvx5sG5hjP1jl+iNZBDFALZava/jaw == X-Received: by 2002:a05:6a00:a215:b0:882:2195:5a6f with SMTP id d2e1a72fcca58-8a9bf04e229mr7517325b3a.43.1793604148654; Sun, 01 Nov 2026 23:22:28 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.240]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8aad7707ed0sm1659597b3a.4.2026.11.01.23.22.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:22:28 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 11/15] bpf, sockmap: Don't copy 0 bytes into a full cork Date: Mon, 2 Nov 2026 07:21:08 +0000 Message-ID: <20261102072112.4160195-12-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Chris Mason psock->cork is a ring. sk_msg_memcopy_from_iter() writes at sg.curr. sk_msg_alloc() adds room at sg.end, where a full ring has a spare element. When only a part of the data fits, tcp_bpf_sendmsg() copies this part and flushes the cork. If nothing fits, it copies 0 bytes. This copy writes nothing, but it moves sg.curr to sg.end and returns -ENOSPC. Thus sendmsg() fails without a flush. sg.curr stays at sg.end, and from there a copy moves it past the spare element. Then a copy can skip the first new element, and the peer gets memory that nobody wrote. Skip the copy when sk_msg_alloc() adds nothing, as tls_sw_sendmsg_locked() does. This pass of the loop flushes the cork. The flush empties the element at sg.curr, thus the copy in the next pass starts at the first new element. Now sendmsg() on a full cork does not fail with ENOSPC. The prog runs on less data than it wants to cork, as it does when a part fits. The first Fixes tag is for the -ENOSPC without a flush. The commit in the second tag added the spare element. Since then sg.curr can move past it. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Fixes: 031097d9e079 ("net: skmsg: fix TLS 1.3 crash with full sk_msg") Signed-off-by: Chris Mason Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- net/ipv4/tcp_bpf.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index d534974c33f8..d8e29b09818c 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -619,8 +619,15 @@ static int tcp_bpf_sendmsg(struct sock *sk, struct msg= hdr *msg, size_t size) copy =3D msg_tx->sg.size - osize; } =20 - ret =3D sk_msg_memcopy_from_iter(sk, &msg->msg_iter, msg_tx, - copy); + /* + * copy is 0 if the ring of the cork was full already and its + * last element could not be extended. Flush the cork below, + * and let the next pass take the data. + */ + ret =3D 0; + if (copy) + ret =3D sk_msg_memcopy_from_iter(sk, &msg->msg_iter, + msg_tx, copy); if (ret < 0) { sk_msg_trim(sk, msg_tx, osize); err =3D ret; --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.50 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604156; b=aBITsYTFS2kFeTnZehugTFVRdTurKubIUSaO49gHAwKf2Ri9NH2uqxiU3fF1fm0Jo5DC meKdYEXwElC1uPmrOYZg885kOtlcOQn7SNxmVhscG+r9FqYYMw16W6tdWHhZhj0+m5UmC l3ox8RnuybUrtzbCb+eonwmX6saPlo1ncUUYZR4bReY6hvCmYZCYQlrxO4DyAcRNKk0ir 8Pjly/E3RPi8ebgOlk87pVueqsSaPxxoM1gW2rcs72kWvNBsuIFEXNU8ZvA0+IFYBOZKq lST6AhbNj8kNMFG67rdS3JpM90KMXFbYwMO7rZUWUGQ0QH8L1POSgLZ37zktM9emsGA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604156; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=zkvPy8BTXAWTFCLyRVJ2sIoHit4yKU7xsRMx7Je7ku4=; b=rFLqyvvnJwzsei7PcqAaWw8gkvNom0r5flnd7UVknwhrT+E+ZiL3nBswvcyIAAXACSYo KI+bpEVSzL8zkWMu5ocjAQ3IXWSFSYpd2otyncRjxS7fAHvdvPOZEYe/NI71AbuJsgoWY Y7sJUr65LipsVkloI/hik6SGjvs+2haRFrYI5q+FccKt/Pee3/ohdgSE+uS1+AjYz5VNu VTFLOwn9kxjauDJb/1JUhK7El8qFztn98nXoxFBT9EWqOAsWF7Iv3OMA4HEGETPDSzc5j 3i523HFMZu9FO4wrpK+eNJQALx62QHWN1yGa/tNS2lwpNKBpQDI7U6LMD86Vx0Jivdw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=TSgtOzSM; arc=none smtp.remote-ip=209.85.216.50 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5012D606A327 for ; Mon, 2 Nov 2026 07:22:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 5012D606A327 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=TSgtOzSM Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-3ae1da332bcso1205505a91.2 for ; Sun, 01 Nov 2026 23:22:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604156; x=1794208956; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=zkvPy8BTXAWTFCLyRVJ2sIoHit4yKU7xsRMx7Je7ku4=; b=TSgtOzSMyvQFGYk+ovpdWC7OIa2E14r+xoa+A+PN0AnAWDSswK+G9GRoL4v00YMm8L CMPq3ycMAar8Px72qvZjFXNX+v5iM8sutHNpR/cF9TCxiMdZmTzseob6UTz1jMTojYak pNDV9mryoEdFUazUDHWpznOrdqhlY3XZ7lzGCLnWTuYUTYTO+HfTk5o64WwZysqQTEQj lQqq8DLdd8YNN8UL1UmbN9+suqVVeQ0YTCwBZqgG3jYtJrdRQ7zLEZwtRGiil/xYKFKQ g4uKGPGm1KI8A7y/g3CF+IfVcran2r68Yo4FHwFYtHzQBjyfdk/S5gxC5u5efJYybsZF 87Eg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604156; x=1794208956; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=zkvPy8BTXAWTFCLyRVJ2sIoHit4yKU7xsRMx7Je7ku4=; b=MWDR+DEzUH/LKX5FEbu3/76s3bx+OedUwVZPaKC05c25BVa+tLqXcBL1LQHF23iw4G cuNHxQx/8Iy4c9eJLVqxy4nQd5WVNgHqsU3jUBAF5kZFBBmOUIm409H6owUqUkfHEidG d007z6MYGPbG7csqJrerDzYMR0iKpkED1ea1rnVhUd7ncyQvPEpv5KLjNq1SboVmAhmw Sn7o4b2bQAqNvpsLmkS0hqOIa9OzxaRGei787zro1clg86yDjH2yLuINHCfHdYHfYpYN MbYBoFPxne7fN0KKnen4ytnoYs/RMOKMNeYyfYqbcV1DazkUDi9UC0UyOSbm0DLuzt9Q 7TDw== X-Forwarded-Encrypted: i=1; AKwUvBz/f6hv57dNNHiiAGhVb1Ts7K7hm1NLuotMMdyAMXr4KBLCw5hSTxbKQbwRsQHdwILWxqDq8w==@lists.linux.dev X-Gm-Message-State: APuU4Z+FLBd3Y3F5g4194yJMlPAoKE0jyhrOz+zsNYApA0Und7LqnHjZ pEh+9JTG8mHzXcKlpmPkRIsD/+qVNzWDQIsDMzfs1p+xorhESJ5UPfeW X-Gm-Gg: AYBFou0wb1SoXsoBzp18dSMipw26rE18TIv2y1nuVfXtgwyZTF12Xd7QD6TYWspJ2/J 78J5amxl3llDR8Xu42dymK9PhJmYCLIv/gE/iymSnAcxaCVSTP/YvQW7d3Ad6g+3k99IkFTxS8j e8uftOSFNSM9wL1L/YWrI2z7vVG4amQdBtnXsogdMoydYl5PYrVkNgKn8pLT47Zer0N3S21pZLl b6HLnrhKEHuz515lN9o4i3/aX3h9mFHTyC5Qs0KTotWFahN1uSrpB7kEkbj8fiy+eDV7Hk1d7Nl PP0wJB73qcK/7UVDvoWSD7bYJ4RZFbTeXinKYi0nws8ffR7b6ZN1gol5uFh5RNy4ZxO6DxQm43H PYela9VFhSNeJ/s9amOIldLgjauyYjTtTW4mnFEgaX/6YUF1PbNnOV2MpbR5H1hCUxuk8miktxQ w7UWhNEEDQFxx8mrXKB9weXTtRWCQQzU4WTrca2eLyNMnKb1boIPxzyTs4qTrJG4I+3qJ7Q5Z0o zDwpOz1G1AYTMXXwZJtStQKLBwa9Ct3+PVgN6x6RBbIktETZNFBejoOG8EDH7UkabEv0LPtBD3k Lw4Am/fW3OQA4yhITn4/RiS8RHAGlfJDKx6h2H/ygjitd4LACZOhmaBf+BWBLCD+ib7GsJLmkRM 6mD8ny/HnZ/jIuC27R3olDD2kEtyeBgZY7ieCXWBH6JqLsv4OWs513XlontOMHtZWiRkS56oRLw == X-Received: by 2002:a17:90b:2e51:b0:3a0:4668:4cb0 with SMTP id 98e67ed59e1d1-3ae8983f049mr7620183a91.47.1793604155368; Sun, 01 Nov 2026 23:22:35 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.240]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3aec233ba08sm3292338a91.0.2026.11.01.23.22.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:22:34 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 12/15] bpf, sockmap: Clear the redirect target before the sk_msg prog runs Date: Mon, 2 Nov 2026 07:21:09 +0000 Message-ID: <20261102072112.4160195-13-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov bpf_msg_redirect_{map,hash}() store the target in msg->sk_redir, without a reference. After the prog has run, sk_psock_msg_verdict() makes SK_PASS a redirect if this field is set. But tcp_bpf_send_verdict() runs the prog again on a cork, and on the rest of a partly sent message. Nothing clears the field between runs. Thus SK_PASS without a new target is a redirect to the old target. If that sock is already free, this is a use after free. Clear msg->sk_redir before each run, as the skb verdict paths do with skb_bpf_redirect_clear(). Only SK_PASS without a target changes. It now sends the data on psock->sk. Then sendmsg() can return another value. A redirect that applies to more bytes uses psock->sk_redir, with its own reference. The counts msg->apply_bytes and msg->cork_bytes stay as today. Fixes: e5cd3abcb31a ("bpf: sockmap, refactor sockmap routines to work with = hashmap") Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- net/core/skmsg.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index a5d498982848..8a3b8536c0c2 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -936,6 +936,13 @@ int sk_psock_msg_verdict(struct sock *sk, struct sk_ps= ock *psock, =20 sk_msg_compute_data_pointers(msg); msg->sk =3D sk; + /* + * The prog may have run on this sk_msg before: it is a cork, or the + * rest of a message of which only a part was sent. The target of that + * run is not the target of this run, and the sk_msg holds no reference + * to it. + */ + msg->sk_redir =3D NULL; ret =3D bpf_prog_run_pin_on_cpu(prog, msg); msg->sk =3D NULL; ret =3D sk_psock_map_verd(ret, msg->sk_redir); --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.52 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604163; b=e+ULwiuooavXwM8MY0k/sxziiTnzbqeFgkdGDQLnWn+iUzOloQzBIBQsxwDdeZoJW/14 rJVSFU7EVHGVz1P+/vXm6rZdtnIlrYfrowUlyB5Q7xpwyQcco+6bmpQMIENy1bHTccXFP BPHI/v/0dbCTrgCnlYKqYXAMaj4tjhLklMTUuuh/+xl0Z9fpmP76UeQCzu9QMbO/tK8Ay 7vOTdlMHf/8y3rhnJW4+AcrlNmKwEFmMpfVGb6F976YzGyhxTa3qoUhuEhLYjMNukbxtf /xEUptS5akPPx/ld/tLfbeX+IcFaeKxszmIymKkM0Lo/FoEj5s6lKtrHWT6/5KxJBUQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604163; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=kV0Z1USHTSrdHd41dgedNKXyUstH61hWM+CBeGfT+gI=; b=P/COVGt5VxnuMOvuNuicTsHhJ/P7DToIpQwzlTTGr0XWbP6A+FtvnW1waCtqe49gL00A Z7gM1D6Bx11ivFwM86JHiDAFlkWRgCTz3CvwAW1bovEHWUyBMa4xHOA4b5feqetryCznB Axr8jj5kg5SVlnU/0xGef2GiMtHtED3b1Qd4T3eqiPULpslixbaFEQGD7HQFTcHnAPVLg eNpujlExUUb6A6FolIe81eqtbhli98mVSRzguE5O+UfyD7qAoxE2exSt8KZ1SziKwlywN ztmoLUaxY0hK9ZGcZMdGRJuPOwcHYo+YoE9dBP24kvYMi+3MyKZ7rC10Do4iSpiQhVA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=VRZcfMop; arc=none smtp.remote-ip=209.85.216.52 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C6F8F606A32C for ; Mon, 2 Nov 2026 07:22:42 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org C6F8F606A32C Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=VRZcfMop Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-3acb11973c3so2018393a91.3 for ; Sun, 01 Nov 2026 23:22:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604162; x=1794208962; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kV0Z1USHTSrdHd41dgedNKXyUstH61hWM+CBeGfT+gI=; b=VRZcfMopDc7vfyx9Yh1khBVtutR5PE0gvFGIL45QRN54J48VZCgEgPuNsE1jaikjGb pKjwnWIH/jS9vcayZ94RjYj4dUL0w2u+NVmnflea0645ZUYupXlZ3V1C0zJ7ty5V5DEN MGH2JHRIm84SJKzGyl8+c/qfji4uvJVL43NsP87ZoJtdE5mt1upghVp6BhnXRkAYHqs5 DAJc1C+Vx48/Q3doKBnRV61mGvwFgAp1W2Fc/odHrNEtHMu2BDB6szO/Ppn7gZcNzqDf M9exvaECxA4uQxhY2ovAN6z2sFtyi5QbYo2C3enzNELaDyhko7omBn9hdGED3xite+UT IfqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604162; x=1794208962; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=kV0Z1USHTSrdHd41dgedNKXyUstH61hWM+CBeGfT+gI=; b=ihDE+oL3/DxJ8p04bjV/dbIBbsJTi5JCcHoOQvWEPCszF/HJh9V4U8Ef1OQ/+wWm+R oubRObYhtzm+7RlLk68qHBMFthAm/vX8Voc0vEUlCDee6YkaqWphk74j0ZRobis/UYS/ zX2FR5lnGMlTmNuULsWKJjUs6thgZaLyZ1IQuzbNnTBvy3T+cCMh27ucLuTBmHXY9qSl foD08Oc9uv6WElPDeUpwEYSXkIMafBITpURVqMKWkLQ7R6hL0FoeduNBscPCsq6m/ezB 3F++rxTsGpU451vNGOacwkPhV3Ly3dkZzE0SqgGW2EIjHYVai+KiJdd6EOxHqe3sxLyA 0Ncg== X-Forwarded-Encrypted: i=1; AKwUvBxycQjku9/H/BW7JWxDPyCDqT1VdH20SedfsI7Ybb8U4L7/FuhIa56302deGCmr61+633dgKg==@lists.linux.dev X-Gm-Message-State: APuU4Z9D8yIp7WHm2PbpfsqMxJ5axKpSM7a3xX0s4jKvj8WlWYCMMCX2 qaWcofF/sFckgm12Md8bRDdEJa0Gp0FsIJ+KbGAU/YXUz6cr/v4tklhz X-Gm-Gg: AYBFou0pgnM2m8B0qcKjEOHDcNCAOhMmnjYL/c6S8y6vTODqtB06tF9tN1sGxsX0Eq7 hsZ/xYU1jVaPdmQM9VXjanYxU8X9Fcids07lSV/72xRvhWoyXI8knmH/7b72I9bOEdqReX78Rcr HkAcFaPT6xwekefltfBJ9ZnhffskoRQQK4sghQsfZgJY7Df3OON7vp9sLcUdpBqMw+Ya6kTKKOL 8yIDn/CJlz7VtQ9DfGfuwPm47cKyYODug6bRzzVDqwWncR9p7PNcuK3CBjdNTdIt1CdTNCWBEzj MNzjNoipGSyEPweFv8wyjdV58GqOiUwwbbk4IiiVnhNvna57VvV4mRzUqfCqHJjMRsiLvJqisSm si9/hYgqFbO9pnVWEp7K1sR4Xn/6Qu2fwCyKXLO9JOvnw5xEzCp0HfIVY3Ib9UkQmual4J0Q6wm CkOZxy6deKSC+kcObtSmPHh9pMbOau2dKX2+/otO233N32RED0KBeLL42f33poXE2Vsf9B164y0 dSJW3JCuqyNXFuOTacsvKpou/NBfMd0hz1XdOIeDBZJ0WNmNHlpgYWK7vxNkuJjapEvvu0BGHdU 120nV8yTNH5OpT3qia6vs5xhfzWokfevn7Ax6SJ8x1Qo/Hdp9tb2wFpdM5sAD334og+JSWz0v5+ kxVEprDuwVjTcG5RwsGmBlKjZp+eS4Ns8N6Qyo0STpS25G6/4s6UmhoHnSg7HCWWvmWMAZTZ/Og == X-Received: by 2002:a17:90a:d2ce:b0:3ac:9176:e83c with SMTP id 98e67ed59e1d1-3ae89720616mr8312885a91.12.1793604162098; Sun, 01 Nov 2026 23:22:42 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.242]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae845df666sm13045987a91.14.2026.11.01.23.22.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:22:41 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 13/15] bpf, sockmap: Check that the redirected message is the cork Date: Mon, 2 Nov 2026 07:21:10 +0000 Message-ID: <20261102072112.4160195-14-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov In tcp_bpf_send_verdict(), msg is psock->cork or the sk_msg on the stack of tcp_bpf_sendmsg(). If psock->cork is not NULL, the SK_REDIRECT branch sets it to NULL before release_sock() and calls kfree(msg) after the redirect. Thus the branch assumes that a cork is msg. This is not true after release_sock(), because a second sender on the same socket can make a cork. The first sender can run the branch again, and then psock->cork is not its msg. Nobody sends or frees the cork of the second sender. kfree() gets the sk_msg on the stack, and the kernel crashes. Compare psock->cork with msg. Nothing changes for one sender, because psock->cork is then NULL or msg. The other branches do not change, and a cork is still not safe for two senders on one socket. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- net/ipv4/tcp_bpf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index d8e29b09818c..b1071b0960cf 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -517,7 +517,11 @@ static int tcp_bpf_send_verdict(struct sock *sk, struc= t sk_psock *psock, psock->eval =3D __SK_NONE; psock->sk_redir =3D NULL; } - if (psock->cork) { + /* + * Another thread can make a cork while this one sends msg + * without the socket lock. Leave that cork alone. + */ + if (psock->cork =3D=3D msg) { cork =3D true; psock->cork =3D NULL; } --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.43 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604170; b=kmlIQtUsCtr1XctDjOHG5eqkvcAcKAkftgLW3sHggloM2dd/mOOXuBDhvAyJsnkfmGUb 4yiQuX6bvv1nfMOHdnaBwTOSYBcPaQAV8APqY2RnwLcOtoBboHFxOKp0p8DviNTOLtkc5 frEVMofihoF4JwY2aGY4nKNDGfIlserbWCTsEQDJ68rngl0NNJ6mnglwRNbjcKi6JRQVy lhO4sYfnsGrNp+xx9ru84dtj8Jlg7PXRRuz2CsgAiSG11Ezx1Lsy+eJLxAhmPFhP0L7SV XD5qXtgm8Uppc/jYPQo3TYDln9sGp5vl+wIogFBPZJW8ZOW6JtS3frgbBgt+otLZm+A== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604170; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=NDzvE7/RY4XbRl2y4tH5HHBBw1sRz/QLmpS0WsHMYoQ=; b=oG5y4f2Bw9SZn2qdrJ0AuiGrL61TeeslVi69xJ3HZ45PmtHRDTm4zxpZvQEEDez/Wpi/ z1y5r3y/EXZHu5DYYZDToYCtJfVeO0wm7kA9G5ulo7ROgW/Vsq4YW2BU4+QJC9iuERV7i uhbfdN3rnpp8E+tNlOyzid3sbba4gQyaSOgc9IKQBxd6Z/ZnvI5tjaRyngfwc2xFupglq gpCOzdg3JyH+dLzgYOu4z4f00rvju9mAZECkNqX4NAbs0SitvV8CXATLI9vh4qogikDzv uMu7dJ8S++oORnBlLNV/xWo3E2EI7C1EXpsO6FwYaxwJj90xL/9DHHAFWjLr6QIEjPA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=cGYcF6rC; arc=none smtp.remote-ip=209.85.216.43 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA695606A33D for ; Mon, 2 Nov 2026 07:22:49 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org AA695606A33D Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=cGYcF6rC Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-3adf5f6833cso1355716a91.0 for ; Sun, 01 Nov 2026 23:22:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604169; x=1794208969; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=NDzvE7/RY4XbRl2y4tH5HHBBw1sRz/QLmpS0WsHMYoQ=; b=cGYcF6rCoqAOr95SFSknGxluRI/zYLdOnhWcDnYCkGD/cSEuSzJ/KIRBp57t1zvz35 xcc1DuaJMPgHjeFzipVidNRUBg9ouLb8rYMALS5YFVijTyDclshkI1R+8qYv8pW+fPsI LVl3i+dRH6LZOPchAr4MDtm6FqAgL7HaB4mc0ePp1UyIIXozyha/dUgrDvPbuk2yDTp5 EuQj/KZACIi1XP0XphENXcNiaetIOsv7arMHxVUPcn4fRabAHvYwc7uqAu4nvih82ur8 m7bqDR3X+g7MTcLn42El/00xPdOQE9HKavSI1Oe0WylkpxypiLmSijN3cpQxQ9WlPFfl /yiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604169; x=1794208969; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=NDzvE7/RY4XbRl2y4tH5HHBBw1sRz/QLmpS0WsHMYoQ=; b=RGR7k0SuTp+VS7r4q/lq8ZfX6/PWqfyxA2o1m+lwtvX8SaVBSpcEtljhd7grHLXD/B EYex30bQAStuTMgnfAvXqpJSw3JMfdDq7iPqYNZLnE1lbJ/aphNA3D4XBbmhZGHu1co8 i7QFKlhdmBDUP7pX2uVSTAKgfpQ3FFPJeOSZT9a6148GFyVFO9/j0l2WOG2L7vQgkoKE Zp+hF1yJCnZ4uMlUpA7VaTPDHRr5U21YdW+xZBeVqcNpkbtTpw2doc50fulsvWB+HGeX c9sv1IbmenkuLaTq2HeTSh+0WPnH7hDcEIqzRlaCks6ddn6WklBU7AaLEdoGLH/KmfSh uWEQ== X-Forwarded-Encrypted: i=1; AKwUvBz6oHm0cnTFuzYpbPFvTfz2K1Q4fB0LU+FL+Mm6vCJnK+/AyTNMAadH8lL0jxBbveIDK5y4BA==@lists.linux.dev X-Gm-Message-State: APuU4Z+yzf9Pwknx+duegaMh9U4TDh6qIb/YWjRFx78Tl27ztRav3Ht/ H1pcXWT60QB//MYmsC9sYn0a7DvdxU/WUvoQRzY6hGzELojnLouEOCaI X-Gm-Gg: AYBFou3JJPbI+r1FPDyUDDfSCd5xvihoS9YGIHNhQxoUgYhOylf/OGiUfjxt0Ace+RF lO9BzoH6l9LvurbydFNZbfRUQZJyDEfqMt48CzNVaM05KG8dm9l8BuyeNxWLzOZPKYvj1TzS7oU yKSs99+U35OpajiTSvajSGFK1jow8YhXiH0YOfQE4rNonaEpHIk+TdpvkOmmOel8HCZkeagcDud KMQoEAWpJ0qHdHxkxbjijo1IWX/5QQh0Vk3iPNXty2pf5ftklRbfgW6BHZA36Dnf2ZPvkVijVUm TGvt8dZ2QrdlZ3B3XTq+g+3uIFT3M/7HGEavuI6HwZAywBRTsUJY1tB+72Sql+offjzRFUZ5NrO +V6w5TFkn9OmHbn45+iCv60vaEW/gpABI/4AS4hO7c46NOElPWlJrTMqhhcbXCn7xN5mYCew3Mq EbQ1pjc/LBcuds/U5tR6w5rBxYHs8rztvI87hUfqSwiAxmNVpRcUcYAu8vto/ow+6RUmZZLhs/O RiReuMqS0PoKdiY0fwkcna4+2oWqCdy149x2SfV614XdFn+OyvLvNYFc7QNV1vdHEDBlriGYTQx PFldhp9EwPJKDisawLoKj4wTJJ83eQM1tyVWnzc87NevvrlAHBbxorFAVjJs5pFSTwJEBaOVhFN 72+e3VuQB1BQE5vFHpxIYfhkIoW4pL+5tGuLbbZczNhtf+lyN+sqCI29pUiqTJ9/aFFk+bcyxY0 c= X-Received: by 2002:a17:90a:e187:b0:3ac:77c8:ac29 with SMTP id 98e67ed59e1d1-3ae896f862emr6963704a91.15.1793604168982; Sun, 01 Nov 2026 23:22:48 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.240]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3aec233ba08sm3293330a91.0.2026.11.01.23.22.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:22:48 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 14/15] bpf, sockmap: Keep the rest of the cork after a redirect Date: Mon, 2 Nov 2026 07:21:11 +0000 Message-ID: <20261102072112.4160195-15-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov After bpf_msg_apply_bytes() a verdict can apply to a part of the message. Then tcp_bpf_send_verdict() sends this part and goes to more_data, and the sk_msg prog runs on the rest. The SK_REDIRECT branch does not go there if the message is the cork. It removes the cork from the psock before it releases the socket lock. After the redirect it frees the cork together with the rest. Thus the rest is lost, and sendmsg() reports it as sent. If bytes remain after the redirect, put the cork back into the psock. Then the prog runs on the rest, as after SK_PASS. If the new verdict is SK_DROP or the push fails, sendmsg() now returns a smaller value or the error. msg->cork_bytes keeps its value, thus the rest can stay in the cork. If the psock has a new cork after lock_sock(), the kernel still frees the rest. If the redirect of a cork fails, sendmsg() still returns success and frees it. Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socke= t TX/RX data") Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- net/ipv4/tcp_bpf.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index b1071b0960cf..788ce08eef4d 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -544,6 +544,14 @@ static int tcp_bpf_send_verdict(struct sock *sk, struc= t sk_psock *psock, if (!cork) *copied -=3D free; } + /* + * The verdict was for tosend bytes. The rest goes back, unless + * another thread made a new cork while the lock was released. + */ + if (cork && msg->sg.size && !psock->cork) { + psock->cork =3D msg; + cork =3D false; + } if (cork) { sk_msg_free(sk, msg); kfree(msg); --=20 2.55.0 From nobody Thu Nov 5 07:30:04 2026 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.50 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793604177; b=nw3m0nnCg/kTPuRMm7EWiPUUnPx30I2DbtQ/RoE/Z92bYZuy8ZkQxaabc6yuu1CVsV+O xRxrxK3RMf/7uCz6yQKoVY11MTn5W78uGlgQMfCd9P2XoxCQScLmvDE8KO9nWmxuJV0N1 dlK2qyI/iraVKCgVW7jtaFgaXOwQ0C5Oc6q7KL2GBGtIy48jr+ZnUdBtJMJL04ivrO8Wt VKO9ksevJpftwxbbpEG9PVZ5Wb4A2LXPz6KxElDNO0v4TAnEnSljwwtULloS0Jm9N3Yda C5eym2Cm8KyYh+Q2JLJq1Qvu0yJjOFpZyrL7ePJD9iFBHfM0N+2MIz63yTg0LyFj5Eg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793604177; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding; bh=iOc7GMvRx5yq+dlbPNKyqujbMy6NRm7RjZeRF42pKDU=; b=IHKVTnP9y6Otvw1jWeG1ylFNlnbtPQdIxo7Z9jHHmsV22DazHrTVowgdcZkYr6UUEae9 6PL6WjYw/nBTCWJd3kD3USdWXwtdeb0QIM31CnXJVj2wHJpjHlvYUbqxFxhGLxOEASM8K WFqMAxbIni950LYobG2XjCD6pgLOPdEf742kD7qcNB2pFpWLtMHMP8SgET+I77BV4MUE/ 4ftUH9nbjI0KEixLzHcYav47L95Haoh6DPYqJS9F0hSFlbuEJShx6+eFAo9HlW9LH2mTb pRycfw29+VaE/NP6bSEqzYP7QirUTbuB1M/wTBBCJbYxOs/pXDFfWRiddz2Zn+CqlGQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=aYlLKTTK; arc=none smtp.remote-ip=209.85.216.50 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF428606A329 for ; Mon, 2 Nov 2026 07:22:56 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org DF428606A329 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20260707 header.b=aYlLKTTK Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-3ac9f49b984so1436306a91.1 for ; Sun, 01 Nov 2026 23:22:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793604176; x=1794208976; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=iOc7GMvRx5yq+dlbPNKyqujbMy6NRm7RjZeRF42pKDU=; b=aYlLKTTKnatNbIlsjI9jHc9Xcl8XjY7laBrXOhbQRhGN2YbVeVxQmmmDhtYivJMqwP 4q5przJXA2pWm3M0Gj3uoiMjZomaIs+SZjd/x4nr6zrcH6SKaRoR8yo/6X1QpSe2JW13 Ap6eEPtH3BBUY8hnqyXm1/dApeFnfOTDOj1J2laACADtZhzAubhVaAqPtzP9SJM4kYGp ZMwCNqOJXStJJKWEWKD4ilOUfk9vwx1QMFNw3g4Cm/Ds/eImR69tf6rEegiQYGmLXseN beYliVnL2O/FUYU7K/3C+FPyvXlPZZNqcXFY7oHxM5tQQtADKiS2EARdYYM+wlAtzZcg o79A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793604176; x=1794208976; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=iOc7GMvRx5yq+dlbPNKyqujbMy6NRm7RjZeRF42pKDU=; b=RhUr3e7q2+p3cy1KYU+nAtDrpUe5aCrSQEKSiXkwbHhM7mYBh6mZeYXkBjTFNcj7JO LfxczdisUg0zsTO64v8rQfJuFZLfwJqeDxOmr8imCw/CGOvLX7EZTDjvM+Xs+sP3SrTF Pe5p1j2GUaplq8ddstGn/hpUcPeeUsYmsiuWXcyFr1NJoOe8le4wwJ0KM4/wjoN6zFGG rPdmgQQx+kOQ0hO+qpmF+9scSFI2rGFR1i83PDa8RFx0DeM6BupHUzOqyXA64alPxm26 4WobG0QnnGBUCKgCYkzls9RAdLI6ge49lu7T3ABjDnT1s9SzBu17TzKVM3+OYTOqnc/m O1WQ== X-Forwarded-Encrypted: i=1; AKwUvBzWiej4tF6XNw0PlbRlhMvgN2+/Y3P6uN5r6E5s9CqL6iBaVnw9SSzoOCqgClvbCUi2bppB1g==@lists.linux.dev X-Gm-Message-State: APuU4Z9ZX+MCun/vgGAOQCIJk+daBX3PeRVvbXrmAbdGb7Z9vKr6kROQ 7WoHkondT66rPuuwp0CR9dI8XXDRstV8aUZAvTytEIdHwPWE2lgl1veO X-Gm-Gg: AYBFou175Seme8bzVIM3+BnoO7rjGvxfzMQyAs4FUvZvt3gP2exdb+UMOIAC93YHk41 7JcNGOvPdd5PnY3aaYNX0LiqMbohfTOeA1axDf+szwmirpSrW//OlfuVw+UsHC0gXIMbrKgaS+h 6wCYrHydOoKL3Jzwrrza4OKGFKhgpMo6UlCk/o2Xk5VdSlp3SX9nG4yQQ7qaOmAVNpiA/tpm0He FBTAqILlj5qy4hZ8DLsDevYfsI/t9PFVE5dzUqFMBaTfbswc/Qa7MJn519li49R4Aeu4pC84d1E g3UV+W/fXVB+bPbHN4DOwK6eN0mYRE/C0wFB1Ivk/2nkrGrMpZ29/I77frgsWjkwScuGVFs6V6S bMYYrzBwBhtwDsvfzhsXtwHDv/R+heqU1bEQKOFq9khn8hH6K1fI3eFWv1jdWUZlu1BX2KzeZJv 85/iMqx8NXnk7vaTFhbsjEYXVLjK3YcWBmZ1lyvGDKtsXy47eDS7cictSzfawVE4Wf1hhEGAlk4 hzD3lPZWlb+Grl4Syp5dozCMcCdBzrBqo8fZ23M+45Wy6zIq/Xj6WvRcOi/bOrXZ6P6Pwhk4pZO J3/Rzy6qm8najX1aseMFnKSiEj8Fl1NMOryDGlDbd5QOBYYFAF+m8R2RRTFfUOlRKklA1+5+dA9 Ci4sqS3AXS/lGVi/SasIIUwpxi+lVLGGIPrrlcqb4xco0YCHHqR/rbTtZ6p46hGxLWT+XnLV+KA == X-Received: by 2002:a17:90b:5347:b0:3ab:be66:ddd3 with SMTP id 98e67ed59e1d1-3ae897994b7mr5021140a91.32.1793604176024; Sun, 01 Nov 2026 23:22:56 -0800 (PST) Received: from coder-ast-ast-dev-ml-0.tail2dda0.ts.net ([153.61.198.240]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ae845aa27esm12518065a91.11.2026.11.01.23.22.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Nov 2026 23:22:54 -0800 (PST) From: Alexei Starovoitov To: bpf@vger.kernel.org, netdev@vger.kernel.org Cc: daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, john.fastabend@gmail.com, jakub@cloudflare.com, jiayuan.chen@linux.dev, davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, kuniyu@google.com, willemb@google.com, matttbe@kernel.org, mptcp@lists.linux.dev, mason@kernel.org, josef@toxicpanda.com Subject: [PATCH bpf v2 15/15] bpf, sockmap: Clear the end mark of elements added by push and pop Date: Mon, 2 Nov 2026 07:21:12 +0000 Message-ID: <20261102072112.4160195-16-alexei.starovoitov@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> References: <20261102072112.4160195-1-alexei.starovoitov@gmail.com> X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Alexei Starovoitov The elements of an sk_msg are in a ring of scatterlist slots. A free slot can have the end mark, because sk_msg_init() marks the last slot of the ring. Also, sg_init_table() in tcp_bpf_push() marks each emptied slot. Thus sk_msg_alloc() and sk_msg_page_add() clear the mark of a new element. bpf_msg_push_data() and bpf_msg_pop_data() fill a free slot with sg_set_page(), which keeps the mark. Then the sk_msg can have an end mark before its last element. bpf_tcp_ingress() copies the mark. Since the commit below, __sk_msg_recvmsg() stops at the mark and frees the sk_msg. The data after the mark is lost, and its pages and memory charge leak. Clear the mark after the two sg_set_page() calls that can fill a free slot. A free slot keeps its mark, as today. tcp_bpf_push() does not read the mark, thus SK_PASS and egress redirect do not change. Fixes: 9974d37ea75f ("skmsg: Fix invalid last sg check in sk_msg_recvmsg()") Signed-off-by: Alexei Starovoitov Reviewed-by: Eric Dumazet Reviewed-by: Jiayuan Chen Reviewed-by: John Fastabend --- net/core/filter.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/filter.c b/net/core/filter.c index 50c0cda778db..d68b52150405 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2995,6 +2995,8 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u= 32, start, msg->sg.size +=3D len; sk_msg_clear_elem_copy(msg, new); sg_set_page(&msg->sg.data[new], page, len + copy, 0); + /* A free slot can have the end mark */ + sg_unmark_end(&msg->sg.data[new]); if (rsge.length) { get_page(sg_page(&rsge)); sk_msg_iter_var_next(new); @@ -3128,6 +3130,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u3= 2, start, sg_set_page(nsge, sg_page(sge), b, sge->offset + pop + a); + sg_unmark_end(nsge); sk_msg_set_elem_copy(msg, i, sge_copy); } else { struct page *page, *orig; --=20 2.55.0