From: Martin KaFai Lau <martin.lau@linux.dev>
To: Kuniyuki Iwashima <kuniyu@google.com>,
Jiayuan Chen <jiayuan.chen@linux.dev>
Cc: John Fastabend <john.fastabend@gmail.com>,
Jakub Sitnicki <jakub@cloudflare.com>,
Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
Kuniyuki Iwashima <kuni1840@gmail.com>,
bpf@vger.kernel.org, netdev@vger.kernel.org
Subject: Re: [PATCH v4 bpf/net 2/6] sockmap: Annotate sk->sk_write_space() for UDP.
Date: Fri, 6 Mar 2026 16:03:47 -0800 [thread overview]
Message-ID: <dc3a8b4c-32f3-4905-8cca-078f220abfef@linux.dev> (raw)
In-Reply-To: <CAAVpQUAJgFtcJGtuMufS9mhaShs7OQDxx7jTGOSbG9wCdeCN7Q@mail.gmail.com>
On 3/4/26 7:43 PM, Kuniyuki Iwashima wrote:
> On Wed, Mar 4, 2026 at 5:48 PM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>>
>> On Sat, Feb 21, 2026 at 11:30:49PM +0800, Kuniyuki Iwashima wrote:
>>> UDP TX skb->destructor() is sock_wfree(), and UDP only
>>> holds lock_sock() for UDP_CORK / MSG_MORE sendmsg().
>>>
>>> Otherwise, sk->sk_write_space() is read locklessly.
>>>
>>> Let's use WRITE_ONCE() and READ_ONCE() for sk->sk_write_space().
>>>
>>> Fixes: 7b98cd42b049 ("bpf: sockmap: Add UDP support")
>>> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
>>> ---
>>> v3: Use WRITE_ONCE() in udp_bpf_update_proto()
>>> v2: Cache sk->sk_write_space in sock_wfree()
>>> ---
>>> net/core/skmsg.c | 2 +-
>>> net/core/sock.c | 8 ++++++--
>>> net/ipv4/udp_bpf.c | 2 +-
>>> 3 files changed, 8 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/net/core/skmsg.c b/net/core/skmsg.c
>>> index 75fa94217e1e..3d7eb2f4ac98 100644
>>> --- a/net/core/skmsg.c
>>> +++ b/net/core/skmsg.c
>>> @@ -1297,7 +1297,7 @@ void sk_psock_start_verdict(struct sock *sk, struct sk_psock *psock)
>>>
>>> psock->saved_data_ready = sk->sk_data_ready;
>>> WRITE_ONCE(sk->sk_data_ready, sk_psock_verdict_data_ready);
>>> - sk->sk_write_space = sk_psock_write_space;
>>> + WRITE_ONCE(sk->sk_write_space, sk_psock_write_space);
>>> }
>>
>> I noticed that Patch 1 and 2 were submitted earlier and are on bpf tree.
>> Given that Eric's commit (which you reviewed) is now in net.git, these two patches
>> should probably be dropped in the next version, right? Just confirming.
>
> I was thinking git can just handle them well, and even the
> patch 2 has a delta in sock_wfree().
At least for patch 1, I am not sure git can handle it well without human
intervention because the sk_write_space is backward from Eric.
For the missing change in sock_wfree (?), it probably makes sense to
create a separate patch on top of Eric's change and target net. My
understanding is patch 3-6 can be on its own without patch 1+2.
next prev parent reply other threads:[~2026-03-07 0:03 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-21 23:30 [PATCH v4 bpf/net 0/6] sockmap: Fix UAF and broken memory accounting for UDP Kuniyuki Iwashima
2026-02-21 23:30 ` [PATCH v4 bpf/net 1/6] sockmap: Annotate sk->sk_data_ready() " Kuniyuki Iwashima
2026-03-05 11:05 ` Jakub Sitnicki
2026-03-05 11:27 ` Jiayuan Chen
2026-02-21 23:30 ` [PATCH v4 bpf/net 2/6] sockmap: Annotate sk->sk_write_space() " Kuniyuki Iwashima
2026-03-05 1:48 ` Jiayuan Chen
2026-03-05 3:43 ` Kuniyuki Iwashima
2026-03-07 0:03 ` Martin KaFai Lau [this message]
2026-03-07 2:51 ` Kuniyuki Iwashima
2026-03-05 11:35 ` Jiayuan Chen
2026-03-05 11:51 ` Jakub Sitnicki
2026-02-21 23:30 ` [PATCH v4 bpf/net 3/6] sockmap: Fix use-after-free in udp_bpf_recvmsg() Kuniyuki Iwashima
2026-03-05 2:30 ` Jiayuan Chen
2026-03-05 3:41 ` Kuniyuki Iwashima
2026-03-05 11:36 ` Jiayuan Chen
2026-03-05 11:39 ` Jakub Sitnicki
2026-03-05 17:46 ` Kuniyuki Iwashima
2026-02-21 23:30 ` [PATCH v4 bpf/net 4/6] sockmap: Inline sk_psock_create_ingress_msg() Kuniyuki Iwashima
2026-03-05 11:44 ` Jakub Sitnicki
2026-02-21 23:30 ` [PATCH v4 bpf/net 5/6] sockmap: Consolidate sk_psock_skb_ingress_self() Kuniyuki Iwashima
2026-02-21 23:30 ` [PATCH v4 bpf/net 6/6] sockmap: Fix broken memory accounting for UDP Kuniyuki Iwashima
2026-03-04 20:04 ` Martin KaFai Lau
2026-03-04 20:14 ` Kuniyuki Iwashima
2026-03-05 6:37 ` Jiayuan Chen
2026-03-05 7:48 ` Kuniyuki Iwashima
2026-03-05 8:30 ` Jiayuan Chen
2026-03-05 9:27 ` Kuniyuki Iwashima
2026-03-05 10:45 ` Jiayuan Chen
2026-03-05 11:04 ` Jiayuan Chen
2026-03-05 17:42 ` Kuniyuki Iwashima
2026-03-06 7:44 ` Jiayuan Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=dc3a8b4c-32f3-4905-8cca-078f220abfef@linux.dev \
--to=martin.lau@linux.dev \
--cc=bpf@vger.kernel.org \
--cc=jakub@cloudflare.com \
--cc=jiayuan.chen@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=kuni1840@gmail.com \
--cc=kuniyu@google.com \
--cc=netdev@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.