From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f68.google.com (mail-ed1-f68.google.com [209.85.208.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68E45304BB8 for ; Wed, 7 Jan 2026 13:01:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.68 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767790893; cv=none; b=dpE5i2KDAaBTTwLknnw+i3One3tuMnxbpnKl94tudGqTrttQmRTccxyYVegGqJ5F7+eg4Z15UF1AdJDoJ1RAFNF4LtFmlQ7CnBcjXyCGBu8RT18yccbuNXXahrqf5DHo65iS7wcfSDEoR4HsLJJ3R7i0X3UgK98OiJDbRzy2A08= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767790893; c=relaxed/simple; bh=ZFBHKnCoBPdFWOIGkoJWE8ZkaUPWI6yc4PvUJ0tWoVo=; h=From:To:Cc:Subject:In-Reply-To:References:Date:Message-ID: MIME-Version:Content-Type; b=ODXZv2QDpQRlN/+aNKJehXV3pev+e6h7prIhKtwLF8e61kfM9Jrrm3VNsbDF7vlypcyUZX89YH4BAAbKcl4PelFDViX+Emnvw6Mq6Ynz/vhOlJ+XtvsFxMnBlRRc4/p2aJJ7akcoGkLbmhyZu2mVPrmz539z1yisB6aR9XzqoJ4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=YS0lg+fh; arc=none smtp.client-ip=209.85.208.68 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="YS0lg+fh" Received: by mail-ed1-f68.google.com with SMTP id 4fb4d7f45d1cf-650854c473fso1596992a12.1 for ; Wed, 07 Jan 2026 05:01:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1767790889; x=1768395689; darn=vger.kernel.org; h=mime-version:message-id:date:references:in-reply-to:subject:cc:to :from:from:to:cc:subject:date:message-id:reply-to; bh=Xir3ca+ukIVh/RHVo7Ct0xUP1DZl1QDE+zdc0E28knM=; b=YS0lg+fhzEioA+R8RLxRY1rbXQ6hSQLdrteJEAnmTIu0R23HV2yEDITk58AnTuRfc8 mMZRMYrKgIIH25vtVbeqvp7dS/epFGw+cfX9TG3LOmnIXSuIpgz16MRuBjYCJN04xI+j BuVpJvCmmzY7GyyyiZP59ttTQMJBhI+F+woOAt1DHnMfXBJKOQbIU0HouBJXA7qBgXnx AbTZChIiXkOhQUWKjaZja9nkhUcOwqTL0EQqj63+/Qkx31KwgeyEKtOZpgRS1qLD1lh5 bDy2NTZkWngCLIFhGY1vvVffQXTLoOf3DHvizYVnzt9/EE4vI/9Lke+kCY/WBZ99J4gu dNzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767790889; x=1768395689; h=mime-version:message-id:date:references:in-reply-to:subject:cc:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Xir3ca+ukIVh/RHVo7Ct0xUP1DZl1QDE+zdc0E28knM=; b=UkMw4h65Yk//HoLpDi94kzgT/O+6Qieg05Xkel29b76ZqARSgp6QaUyIq0GJk+bFbj G/V9gNvWugOyBsgmGkQKZV9JXks2ooDDYWyKQhIzAvh1phtDpLqxKfhenOaSJN2fKQCN MH9YpLaQ5txDNUmzjXqWPLqz80lF1VmCstSsNGhi2xDQFQ7Om/prb7A9hxlTTH3+w+9b ap2KO4dveOZhXZ4lkLyMLUYCOKB1kGfdqIviAPDh6ISBUDod1lQ2A4LAkCD7ewdSbWK7 /5+ukrXVXq9jbkBXZTGMYKd5nyjLNdseXHtWGYfhmxgYyQTDzVDRlEDf/E2JeYMbO7Jt BDrA== X-Forwarded-Encrypted: i=1; AJvYcCVghIWYY6MRMAj4e/tjAvdEML3stJ9XcbUE6wc7r/DisZsLY0mNPSgu4/kk7cgXS57UHW5oW8GOhixernQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzUJpM8qneQxAIzupvOhJF6RSEfgrfpdptJQsDy9BMD2LSvwWcb HAPhGHo27F+AuDUg53vw2OOEeusbAzz5W1x7O0gUhHjeMRXWSGyM8674wobbkUg57jE= X-Gm-Gg: AY/fxX68Evt22VS0kPvzRX2ZlfKzewFenIkB/CY+zKDM5L7LB1Uv19MWqr7/ioZZkQj y0GKVYzz1S/77EjSkA4KRMTqxqhiNsy93Pt6sxIWAJL8Vi6v8ATJ2XMKwTqDdX2ARIdoSpuBtdb vG0hVpNCVBPSACssHleC4ccG/OWjBYn2A7eyBbb8Uztrtf1RUfelNjaEfRMuR9mKqmogSLozpjb aC/Wpfdm2Svpu/D0MaFTYUvuQ9tm6vmChLuqN3tnGzsDAGIuwRbFyWowU1z9hjlW4W5ZlKcILSN kkEgBcWeqlEqstgl56I6FKYyVK53lSgeQgF0DhtQm60D1g3TaJpbmFqC+9/vzlGz3LbNfcRdSjp OeEhMiBMVTWUf7AJq5pOETDAHfGntFd06KtgdMiPfXv2+k4cFTXArY0d/EAoQcUpO/zTp/RT2zG ilYyiLK3H3aUyVUg== X-Google-Smtp-Source: AGHT+IEHgppdZ9+MA6XjO99QW33t8OQ8GPnpF0g3kbKM6o5sKERqSqJ/zi1nzB6V76byczxXQVMLPg== X-Received: by 2002:aa7:d74d:0:b0:649:81d7:581c with SMTP id 4fb4d7f45d1cf-6507bc3d7fbmr4690740a12.1.1767790888994; Wed, 07 Jan 2026 05:01:28 -0800 (PST) Received: from cloudflare.com ([2a09:bac5:5063:2969::420:12]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6507b9d4c89sm4429789a12.10.2026.01.07.05.01.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 07 Jan 2026 05:01:28 -0800 (PST) From: Jakub Sitnicki To: Jiayuan Chen Cc: bpf@vger.kernel.org, John Fastabend , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Neal Cardwell , Kuniyuki Iwashima , David Ahern , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , Stefano Garzarella , Michal Luczaj , Cong Wang , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: Re: [PATCH bpf-next v5 1/3] bpf, sockmap: Fix incorrect copied_seq calculation In-Reply-To: <20260106051458.279151-2-jiayuan.chen@linux.dev> (Jiayuan Chen's message of "Tue, 6 Jan 2026 13:14:27 +0800") References: <20260106051458.279151-1-jiayuan.chen@linux.dev> <20260106051458.279151-2-jiayuan.chen@linux.dev> Date: Wed, 07 Jan 2026 14:01:27 +0100 Message-ID: <87ms2pinko.fsf@cloudflare.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain On Tue, Jan 06, 2026 at 01:14 PM +08, Jiayuan Chen wrote: > A socket using sockmap has its own independent receive queue: ingress_msg. > This queue may contain data from its own protocol stack or from other > sockets. > > The issue is that when reading from ingress_msg, we update tp->copied_seq > by default. However, if the data is not from its own protocol stack, > tcp->rcv_nxt is not increased. Later, if we convert this socket to a > native socket, reading from this socket may fail because copied_seq might > be significantly larger than rcv_nxt. > > This fix also addresses the syzkaller-reported bug referenced in the > Closes tag. > > This patch marks the skmsg objects in ingress_msg. When reading, we update > copied_seq only if the data is from its own protocol stack. > > FD1:read() > -- FD1->copied_seq++ > | [read data] > | > [enqueue data] v > [sockmap] -> ingress to self -> ingress_msg queue > FD1 native stack ------> ^ > -- FD1->rcv_nxt++ -> redirect to other | [enqueue data] > | | > | ingress to FD1 > v ^ > ... | [sockmap] > FD2 native stack > > Closes: https://syzkaller.appspot.com/bug?extid=06dbd397158ec0ea4983 > Fixes: 04919bed948dc ("tcp: Introduce tcp_read_skb()") > Signed-off-by: Jiayuan Chen > --- > include/linux/skmsg.h | 2 ++ > net/core/skmsg.c | 25 ++++++++++++++++++++++--- > net/ipv4/tcp_bpf.c | 5 +++-- > 3 files changed, 27 insertions(+), 5 deletions(-) > > diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h > index 49847888c287..0323a2b6cf5e 100644 > --- a/include/linux/skmsg.h > +++ b/include/linux/skmsg.h > @@ -141,6 +141,8 @@ int sk_msg_memcopy_from_iter(struct sock *sk, struct iov_iter *from, > struct sk_msg *msg, u32 bytes); > int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, > int len, int flags); > +int __sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, > + int len, int flags, int *from_self_copied); > bool sk_msg_is_readable(struct sock *sk); > > static inline void sk_msg_check_to_free(struct sk_msg *msg, u32 i, u32 bytes) > diff --git a/net/core/skmsg.c b/net/core/skmsg.c > index 2ac7731e1e0a..d73e03f7713a 100644 > --- a/net/core/skmsg.c > +++ b/net/core/skmsg.c > @@ -409,14 +409,14 @@ int sk_msg_memcopy_from_iter(struct sock *sk, struct iov_iter *from, > } > EXPORT_SYMBOL_GPL(sk_msg_memcopy_from_iter); > > -/* Receive sk_msg from psock->ingress_msg to @msg. */ > -int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, > - int len, int flags) > +int __sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, > + int len, int flags, int *from_self_copied) > { > struct iov_iter *iter = &msg->msg_iter; > int peek = flags & MSG_PEEK; > struct sk_msg *msg_rx; > int i, copied = 0; > + bool to_self; Nit: Can we unify the naming and make it read more naturally? s/to_self/from_self/ s/from_self_copied/copied_from_self/ Otherwise LGTM: Reviewed-by: Jakub Sitnicki