Re: [PATCH] bpf, sockmap: Fix self-redirect copied_seq double-counting

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unconditionally skipping tcp_eat_skb() for all self-redirects leaks sequence accounting (copied_seq) for egress redirects, synchronous redirect errors, and psock detach drops.
--

commit 8f3d3d5b6b4f4a55b1a1c00df40c2762471ef372
Author: Geliang Tang <geliang@kernel.org>

bpf, sockmap: Fix self-redirect copied_seq double-counting

This commit attempts to fix a double-counting issue in copied_seq when a
BPF stream_verdict program redirects an skb back to the same socket with
BPF_F_INGRESS. It does so by skipping tcp_eat_skb() for self-redirects.

> diff --git a/net/core/skmsg.c b/net/core/skmsg.c
> index 2521b643fa05d..5fa7b9639eefe 100644
> --- a/net/core/skmsg.c
> +++ b/net/core/skmsg.c
> @@ -1039,10 +1039,14 @@ static int sk_psock_verdict_apply(struct sk_psock *psock, struct sk_buff *skb,
[ ... ]
> -	case __SK_REDIRECT:
> -		tcp_eat_skb(psock->sk, skb);
> +	case __SK_REDIRECT: {
> +		struct sock *dst = skb_bpf_redirect_fetch(skb);
> +
> +		if (dst != psock->sk)
> +			tcp_eat_skb(psock->sk, skb);
>  		err = sk_psock_skb_redirect(psock, skb);
>  		break;
> +	}
>  	case __SK_DROP:

[Severity: High]
Does conditionally skipping tcp_eat_skb() here leak sequence accounting
(copied_seq) if the self-redirect encounters an error or is an egress
redirect?

If a BPF program returns SK_REDIRECT to its own socket, tcp_eat_skb() is
bypassed. However, if this is an egress redirect (without BPF_F_INGRESS),
the packet is sent out via skb_send_sock() instead of being read by
tcp_bpf_recvmsg_parser().

Similarly, if sk_psock_skb_redirect() fails synchronously (for example, if
!sk_psock_test_state(psock_other, SK_PSOCK_TX_ENABLED)) and calls
sock_drop(), the packet is also lost.

In both cases, the packet is permanently removed from the ingress path
without advancing copied_seq. Could this cause a permanent sequence
desynchronization that stalls the receive window and triggers a kernel
warning in tcp_recvmsg_locked()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/b840c35fdfdf36e9fddedfa645b12699bc51aa34.1787968065.git.tanggeliang@kylinos.cn?part=1