Re: [PATCH net 1/1] tcp_bpf: sync copied_seq after pre-accept data

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Thu, Oct 22, 2026 at 10:46 PM Zhiling Zou <zhilinz@nebusec.ai> wrote:
> Refresh the local sequence from tcp->copied_seq after tcp_data_ready()
> processes the pre-accept queue. This preserves progress made by the
> sockmap path, including when the receive queue could not be fully drained.

tcp_msg_wait_data() has the same problem.
sk_wait_event() releases the socket lock. A packet arrives, the verdict
prog returns SK_DROP or redirects it to another socket and tcp_eat_skb()
advances copied_seq. The reader wakes up, ingress_msg is empty and

    copied = -EAGAIN;
  out:
    WRITE_ONCE(tcp->copied_seq, seq);

rewinds it. So blocking recv() leaves copied_seq behind without any data
queued before accept(), and tcp_recvmsg_locked() hits the same WARN
after the socket is removed from the map.

The snapshot is the bug. copied_seq changes only under the socket lock.
Just add what was copied to it at the end.
Like this:

diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index d5fcf3c..d85fdd5 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -227,7 +227,6 @@ static int tcp_bpf_recvmsg_parser(struct sock *sk,
 	struct tcp_sock *tcp;
 	int copied_from_self = 0;
 	int copied = 0;
-	u32 seq;

 	if (unlikely(flags & MSG_ERRQUEUE))
 		return inet_recv_error(sk, msg, len);
@@ -241,7 +240,6 @@ static int tcp_bpf_recvmsg_parser(struct sock *sk,

 	lock_sock(sk);
 	tcp = tcp_sk(sk);
-	seq = tcp->copied_seq;
 	/* We may have received data on the sk_receive_queue pre-accept and
 	 * then we can not use read_skb in this context because we haven't
 	 * assigned a sk_socket yet so have no link to the ops. The work-around
@@ -273,11 +271,10 @@ msg_bytes_ready:

 		if (is_fin) {
 			copied = 0;
-			seq++;
+			copied_from_self++;
 			goto out;
 		}
 	}
-	seq += copied_from_self;
 	if (!copied) {
 		long timeo;
 		int data;
@@ -320,7 +317,7 @@ msg_bytes_ready:
 	}
 out:
 	if (!peek)
-		WRITE_ONCE(tcp->copied_seq, seq);
+		WRITE_ONCE(tcp->copied_seq, tcp->copied_seq + copied_from_self);
 	tcp_rcv_space_adjust(sk);
 	if (copied > 0)
 		__tcp_cleanup_rbuf(sk, copied);

> Link: https://sashiko.dev/#/patchset/20260630205043.184894-1-rhkrqnwk98@gmail.com
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260630205043.184894-1-rhkrqnwk98@gmail.com

That's a review of a different series.
Drop these tags.

sockmap fixes go via bpf tree. Pls tag the respin as [PATCH bpf v2].

pw-bot: cr