Re: [PATCH] bpf, sockmap: Fix ring capacity invariant break in bpf_msg_push_data()

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Wed, Nov 11, 2026 at 07:13 PM bo cao <treebacker@foxmail.com> wrote:
> A push at msg->size ends the element walk on the ring's free slot, so
> the "no space, absorb by copy" fallback reads the free slot's length
> instead of the last live element's. Nothing is absorbed and the split

Way too long.
A push at msg->size on a full ring reads the length of the free slot.
It is 0, so nothing is copied and sg.end moves onto sg.start.
The ring looks empty and the next push overwrites live elements.
The prog needs CAP_BPF and CAP_NET_ADMIN.
That's all that needs to be said.

> put_page() on a zeroed scatterlist entry. With the fix the helper
> returns -ENOSPC, the message frees normally, and the crash is gone.

It doesn't.
I don't think you tested your patch.

> Fixes: 6fff607e2f14 ("bpf: sk_msg program helper bpf_msg_push_data")

Wrong tag.
A push at msg->size returned -EINVAL before
commit 15ab0548e310 ("bpf, sockmap: Several fixes to bpf_msg_push_data").

> +	if (!space || (space == 1 && start != offset)) {
> +		/* A push at msg->size leaves the walk on the ring's free
[...]
> +		if (i == msg->sg.end) {
> +			if (!space) {
> +				sk_msg_iter_var_prev(i);
> +				copy = msg->sg.data[i].length;
> +				if (!copy)
> +					return -ENOSPC;
> +			}
> +		} else {
> +			copy = msg->sg.data[i].length;
> +		}
> +	}

This is overkill.
Replace your slop with improved slop:

diff --git a/net/core/filter.c b/net/core/filter.c
index 9245009..c0db554 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2897,6 +2897,10 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
 	if (start > offset + l)
 		return -EINVAL;

+	/* A push at the end of the msg works on the last element */
+	if (i == msg->sg.end && start != offset)
+		sk_msg_iter_var_prev(i);
+
 	space = MAX_MSG_FRAGS - sk_msg_elem_used(msg);

 	/* If no space available will fallback to copy, we need at
@@ -2922,8 +2926,6 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,

 		raw = page_address(page);

-		if (i == msg->sg.end)
-			sk_msg_iter_var_prev(i);
 		psge = sk_msg_elem(msg, i);
 		front = start - offset;
 		back = psge->length - front;
@@ -2945,8 +2947,6 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
 	}

 	if (start - offset) {
-		if (i == msg->sg.end)
-			sk_msg_iter_var_prev(i);
 		psge = sk_msg_elem(msg, i);
 		rsge = sk_msg_elem_cpy(msg, i);
 		rsge_copy = sk_msg_elem_is_copy(msg, i);

Pls tag the respin as [PATCH bpf v2].

pw-bot: cr