public inbox for netdev@vger.kernel.org
 help / color / mirror / Atom feed
From: kernel test robot <lkp@intel.com>
To: Kuniyuki Iwashima <kuniyu@google.com>,
	John Fastabend <john.fastabend@gmail.com>,
	Jakub Sitnicki <jakub@cloudflare.com>
Cc: oe-kbuild-all@lists.linux.dev,
	Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
	Cong Wang <cong.wang@bytedance.com>,
	Kuniyuki Iwashima <kuniyu@google.com>,
	bpf@vger.kernel.org, netdev@vger.kernel.org,
	syzbot+5b3b7e51dda1be027b7a@syzkaller.appspotmail.com
Subject: Re: [PATCH v1 bpf/net 6/6] sockmap: Fix broken memory accounting for UDP.
Date: Mon, 16 Feb 2026 12:26:28 +0800	[thread overview]
Message-ID: <202602161215.LxHBWhAv-lkp@intel.com> (raw)
In-Reply-To: <20260215204353.3645744-7-kuniyu@google.com>

Hi Kuniyuki,

kernel test robot noticed the following build errors:

[auto build test ERROR on linus/master]
[also build test ERROR on next-20260213]
[cannot apply to horms-ipvs/master v6.19]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Kuniyuki-Iwashima/sockmap-Annotate-sk-sk_data_ready-for-UDP/20260216-044819
base:   linus/master
patch link:    https://lore.kernel.org/r/20260215204353.3645744-7-kuniyu%40google.com
patch subject: [PATCH v1 bpf/net 6/6] sockmap: Fix broken memory accounting for UDP.
config: x86_64-buildonly-randconfig-004-20260216 (https://download.01.org/0day-ci/archive/20260216/202602161215.LxHBWhAv-lkp@intel.com/config)
compiler: gcc-13 (Debian 13.3.0-16) 13.3.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260216/202602161215.LxHBWhAv-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202602161215.LxHBWhAv-lkp@intel.com/

All errors (new ones prefixed by >>):

   ld: net/core/skmsg.o: in function `sk_psock_skb_ingress':
>> net/core/skmsg.c:608:(.text+0x2037): undefined reference to `udp_sock_rfree'


vim +608 net/core/skmsg.c

   575	
   576	static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb,
   577					u32 off, u32 len, gfp_t gfp_flags, bool take_ref)
   578	{
   579		struct sock *sk = psock->sk;
   580		bool is_udp = sk_is_udp(sk);
   581		struct sk_msg *msg;
   582		int err = -EAGAIN;
   583	
   584		msg = alloc_sk_msg(gfp_flags);
   585		if (!msg)
   586			goto out;
   587	
   588		if (is_udp)
   589			spin_lock_bh(&sk->sk_receive_queue.lock);
   590	
   591		if (skb->sk != sk || is_udp) {
   592			if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
   593				goto unlock;
   594	
   595			if (!sk_rmem_schedule(sk, skb, skb->truesize))
   596				goto unlock;
   597		}
   598	
   599		/* This will transition ownership of the data from the socket where
   600		 * the BPF program was run initiating the redirect to the socket
   601		 * we will eventually receive this data on. The data will be released
   602		 * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
   603		 * into user buffers.
   604		 */
   605		skb_set_owner_r(skb, sk);
   606	
   607		if (is_udp) {
 > 608			skb->destructor = udp_sock_rfree;
   609			spin_unlock_bh(&sk->sk_receive_queue.lock);
   610		}
   611	
   612		err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg, take_ref);
   613		if (err < 0)
   614			goto free;
   615	out:
   616		return err;
   617	
   618	unlock:
   619		if (is_udp)
   620			spin_unlock_bh(&sk->sk_receive_queue.lock);
   621	free:
   622		kfree(msg);
   623		goto out;
   624	}
   625	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

      parent reply	other threads:[~2026-02-16  4:27 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-02-15 20:41 [PATCH v1 bpf/net 0/6] sockmap: Fix UAF and broken memory accounting for UDP Kuniyuki Iwashima
2026-02-15 20:41 ` [PATCH v1 bpf/net 1/6] sockmap: Annotate sk->sk_data_ready() " Kuniyuki Iwashima
2026-02-15 20:41 ` [PATCH v1 bpf/net 2/6] sockmap: Annotate sk->sk_write_space() " Kuniyuki Iwashima
2026-02-15 21:21   ` bot+bpf-ci
2026-02-16  1:04     ` Kuniyuki Iwashima
2026-02-15 20:41 ` [PATCH v1 bpf/net 3/6] sockmap: Fix use-after-free in udp_bpf_recvmsg() Kuniyuki Iwashima
2026-02-15 20:41 ` [PATCH v1 bpf/net 4/6] sockmap: Pass gfp_t flag to sk_psock_skb_ingress() Kuniyuki Iwashima
2026-02-15 20:41 ` [PATCH v1 bpf/net 5/6] sockmap: Consolidate sk_psock_skb_ingress_self() Kuniyuki Iwashima
2026-02-15 21:50   ` bot+bpf-ci
2026-02-16  1:05     ` Kuniyuki Iwashima
2026-02-15 20:41 ` [PATCH v1 bpf/net 6/6] sockmap: Fix broken memory accounting for UDP Kuniyuki Iwashima
2026-02-16  2:50   ` kernel test robot
2026-02-16  5:18     ` Kuniyuki Iwashima
2026-02-16  4:26   ` kernel test robot [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=202602161215.LxHBWhAv-lkp@intel.com \
    --to=lkp@intel.com \
    --cc=bpf@vger.kernel.org \
    --cc=cong.wang@bytedance.com \
    --cc=jakub@cloudflare.com \
    --cc=john.fastabend@gmail.com \
    --cc=kuniyu@google.com \
    --cc=netdev@vger.kernel.org \
    --cc=oe-kbuild-all@lists.linux.dev \
    --cc=syzbot+5b3b7e51dda1be027b7a@syzkaller.appspotmail.com \
    --cc=willemdebruijn.kernel@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox