Re: [PATCH bpf] bpf, sockmap: fix BUG_ON in skb_to_sgvec() on a resized ingress skb

[John Fastabend <john.fastabend@gmail.com>]

On Sat, Jun 13, 2026 at 08:37:47AM +0000, sashiko-bot@kernel.org wrote:
>Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>- [High] Returning -EINVAL when an SKB is shrunk by a BPF program causes the `sk_psock_backlog` worker to incorrectly treat the valid shrink as a fatal error, leading to an unintended broken pipe (EPIPE).
>--
>
>commit 54e4eaf90ac6a727b56c416746a6a961673b62f5
>Author: Sechang Lim <rhkrqnwk98@gmail.com>
>
>bpf, sockmap: fix BUG_ON in skb_to_sgvec() on a resized ingress skb
>
>This commit prevents a BUG_ON when a BPF program shrinks an ingress SKB.
>It accomplishes this by clamping the length to skb->len - off and
>returning -EINVAL if off is already past the SKB length.
>
>> diff --git a/net/core/skmsg.c b/net/core/skmsg.c
>> index e1850caf1a71a..2961178ebd1e1 100644
>> --- a/net/core/skmsg.c
>> +++ b/net/core/skmsg.c
>> @@ -550,6 +550,10 @@ static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb,
>>  {
>>  	int num_sge, copied;
>>
>> +	if (off >= skb->len)
>> +		return -EINVAL;
>> +	len = min_t(u32, len, skb->len - off);
>> +
>
>[Severity: High]
>Could returning -EINVAL here cause the sk_psock_backlog() worker to
>incorrectly treat a valid SKB shrink as a permanent error?

Yep it treats it as a hard error and breaks the socket. The above
patch does enough to fix the BUG but doesn't actually fix the
underlying issue.

Sashiko AI review · 
https://sashiko.dev/#/patchset/20260613082442.3252576-1-rhkrqnwk98@gmail.com?part=1