[PATCH bpf v3] bpf, sockmap: Fix ring capacity invariant break in bpf_msg_push_data()

[PATCH bpf v3] bpf, sockmap: Fix ring capacity invariant break in bpf_msg_push_data()

[bo cao]

From: Bo Cao <treebacker@foxmail.com>

A push at msg->size on a full ring reads the length of the free slot.
It is 0, so nothing is copied and sg.end moves onto sg.start.
The ring looks empty and the next push overwrites live elements.
The prog needs CAP_BPF and CAP_NET_ADMIN.

Fixes: 15ab0548e310 ("bpf, sockmap: Several fixes to bpf_msg_push_data")
Signed-off-by: Bo Cao <treebacker@foxmail.com>
---
v2 review: https://lore.kernel.org/bpf/4d767dd560c330fee6b646e99675d84ac5ddecc3f34e2cfc25eeaf580e9bf8d0@mail.kernel.org

Changes since v2, per the review: require two slots only when the
split leaves a non-empty remainder (start < offset + l). A push at
the end of the last element with one free slot keeps taking the
split path (zero-copy, one slot) instead of the copy path and its
get_order(copy + len) GFP_ATOMIC allocation.

Tested on 7.4.0-rc2 + the bpf master sockmap series (arm64 QEMU
virt): the crash reproducer exits cleanly (no WARN, no Oops), and
the reproducer that drives the corrupted state finds no corruption
in ~1900 rounds. Triggering requires CAP_BPF and CAP_NET_ADMIN;
the reproducers run with those capabilities granted via setcap.
---
 net/core/filter.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 1f81a3dd6a5c..0747f1a4a9c5 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2883,6 +2883,10 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
 	if (start > offset + l)
 		return -EINVAL;
 
+	/* A push at the end of the msg works on the last element */
+	if (i == msg->sg.end && start != offset)
+		sk_msg_iter_var_prev(i);
+
 	space = MAX_MSG_FRAGS - sk_msg_elem_used(msg);
 
 	/* If no space available will fallback to copy, we need at
@@ -2892,7 +2896,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
 	 * offset case because its the common case for inserting a
 	 * header.
 	 */
-	if (!space || (space == 1 && start != offset))
+	if (!space || (space == 1 && start != offset && start < offset + l))
 		copy = msg->sg.data[i].length;
 
 	if (unlikely(copy + len < copy))
@@ -2908,8 +2912,6 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
 
 		raw = page_address(page);
 
-		if (i == msg->sg.end)
-			sk_msg_iter_var_prev(i);
 		psge = sk_msg_elem(msg, i);
 		front = start - offset;
 		back = psge->length - front;
@@ -2931,8 +2933,6 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
 	}
 
 	if (start - offset) {
-		if (i == msg->sg.end)
-			sk_msg_iter_var_prev(i);
 		psge = sk_msg_elem(msg, i);
 		rsge = sk_msg_elem_cpy(msg, i);
 		rsge_copy = sk_msg_elem_is_copy(msg, i);
-- 
2.39.5 (Apple Git-154)

Re: [PATCH bpf v3] bpf, sockmap: Fix ring capacity invariant break in bpf_msg_push_data()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Thu, 12 Nov 2026 15:09:53 +0800 you wrote:
> From: Bo Cao <treebacker@foxmail.com>
> 
> A push at msg->size on a full ring reads the length of the free slot.
> It is 0, so nothing is copied and sg.end moves onto sg.start.
> The ring looks empty and the next push overwrites live elements.
> The prog needs CAP_BPF and CAP_NET_ADMIN.
> 
> [...]

Here is the summary with links:
  - [bpf,v3] bpf, sockmap: Fix ring capacity invariant break in bpf_msg_push_data()
    https://git.kernel.org/bpf/bpf/c/f6562cd116a0

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html