From: Martin KaFai Lau <martin.lau@linux.dev>
To: Kuniyuki Iwashima <kuniyu@google.com>,
Jiayuan Chen <jiayuan.chen@linux.dev>
Cc: John Fastabend <john.fastabend@gmail.com>,
Jakub Sitnicki <jakub@cloudflare.com>,
Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
Kuniyuki Iwashima <kuni1840@gmail.com>,
bpf@vger.kernel.org, netdev@vger.kernel.org
Subject: Re: [PATCH v4 bpf/net 2/6] sockmap: Annotate sk->sk_write_space() for UDP.
Date: Fri, 6 Mar 2026 16:03:47 -0800 [thread overview]
Message-ID: <dc3a8b4c-32f3-4905-8cca-078f220abfef@linux.dev> (raw)
In-Reply-To: <CAAVpQUAJgFtcJGtuMufS9mhaShs7OQDxx7jTGOSbG9wCdeCN7Q@mail.gmail.com>
On 3/4/26 7:43 PM, Kuniyuki Iwashima wrote:
> On Wed, Mar 4, 2026 at 5:48 PM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>>
>> On Sat, Feb 21, 2026 at 11:30:49PM +0800, Kuniyuki Iwashima wrote:
>>> UDP TX skb->destructor() is sock_wfree(), and UDP only
>>> holds lock_sock() for UDP_CORK / MSG_MORE sendmsg().
>>>
>>> Otherwise, sk->sk_write_space() is read locklessly.
>>>
>>> Let's use WRITE_ONCE() and READ_ONCE() for sk->sk_write_space().
>>>
>>> Fixes: 7b98cd42b049 ("bpf: sockmap: Add UDP support")
>>> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
>>> ---
>>> v3: Use WRITE_ONCE() in udp_bpf_update_proto()
>>> v2: Cache sk->sk_write_space in sock_wfree()
>>> ---
>>> net/core/skmsg.c | 2 +-
>>> net/core/sock.c | 8 ++++++--
>>> net/ipv4/udp_bpf.c | 2 +-
>>> 3 files changed, 8 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/net/core/skmsg.c b/net/core/skmsg.c
>>> index 75fa94217e1e..3d7eb2f4ac98 100644
>>> --- a/net/core/skmsg.c
>>> +++ b/net/core/skmsg.c
>>> @@ -1297,7 +1297,7 @@ void sk_psock_start_verdict(struct sock *sk, struct sk_psock *psock)
>>>
>>> psock->saved_data_ready = sk->sk_data_ready;
>>> WRITE_ONCE(sk->sk_data_ready, sk_psock_verdict_data_ready);
>>> - sk->sk_write_space = sk_psock_write_space;
>>> + WRITE_ONCE(sk->sk_write_space, sk_psock_write_space);
>>> }
>>
>> I noticed that Patch 1 and 2 were submitted earlier and are on bpf tree.
>> Given that Eric's commit (which you reviewed) is now in net.git, these two patches
>> should probably be dropped in the next version, right? Just confirming.
>
> I was thinking git can just handle them well, and even the
> patch 2 has a delta in sock_wfree().
At least for patch 1, I am not sure git can handle it well without human
intervention because the sk_write_space is backward from Eric.
For the missing change in sock_wfree (?), it probably makes sense to
create a separate patch on top of Eric's change and target net. My
understanding is patch 3-6 can be on its own without patch 1+2.
next prev parent reply other threads:[~2026-03-07 0:04 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-21 23:30 [PATCH v4 bpf/net 0/6] sockmap: Fix UAF and broken memory accounting for UDP Kuniyuki Iwashima
2026-02-21 23:30 ` [PATCH v4 bpf/net 1/6] sockmap: Annotate sk->sk_data_ready() " Kuniyuki Iwashima
2026-03-05 11:05 ` Jakub Sitnicki
2026-03-05 11:27 ` Jiayuan Chen
2026-02-21 23:30 ` [PATCH v4 bpf/net 2/6] sockmap: Annotate sk->sk_write_space() " Kuniyuki Iwashima
2026-03-05 1:48 ` Jiayuan Chen
2026-03-05 3:43 ` Kuniyuki Iwashima
2026-03-07 0:03 ` Martin KaFai Lau [this message]
2026-03-07 2:51 ` Kuniyuki Iwashima
2026-03-05 11:35 ` Jiayuan Chen
2026-03-05 11:51 ` Jakub Sitnicki
2026-02-21 23:30 ` [PATCH v4 bpf/net 3/6] sockmap: Fix use-after-free in udp_bpf_recvmsg() Kuniyuki Iwashima
2026-03-05 2:30 ` Jiayuan Chen
2026-03-05 3:41 ` Kuniyuki Iwashima
2026-03-05 11:36 ` Jiayuan Chen
2026-03-05 11:39 ` Jakub Sitnicki
2026-03-05 17:46 ` Kuniyuki Iwashima
2026-02-21 23:30 ` [PATCH v4 bpf/net 4/6] sockmap: Inline sk_psock_create_ingress_msg() Kuniyuki Iwashima
2026-03-05 11:44 ` Jakub Sitnicki
2026-02-21 23:30 ` [PATCH v4 bpf/net 5/6] sockmap: Consolidate sk_psock_skb_ingress_self() Kuniyuki Iwashima
2026-02-21 23:30 ` [PATCH v4 bpf/net 6/6] sockmap: Fix broken memory accounting for UDP Kuniyuki Iwashima
2026-03-04 20:04 ` Martin KaFai Lau
2026-03-04 20:14 ` Kuniyuki Iwashima
2026-03-05 6:37 ` Jiayuan Chen
2026-03-05 7:48 ` Kuniyuki Iwashima
2026-03-05 8:30 ` Jiayuan Chen
2026-03-05 9:27 ` Kuniyuki Iwashima
2026-03-05 10:45 ` Jiayuan Chen
2026-03-05 11:04 ` Jiayuan Chen
2026-03-05 17:42 ` Kuniyuki Iwashima
2026-03-06 7:44 ` Jiayuan Chen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=dc3a8b4c-32f3-4905-8cca-078f220abfef@linux.dev \
--to=martin.lau@linux.dev \
--cc=bpf@vger.kernel.org \
--cc=jakub@cloudflare.com \
--cc=jiayuan.chen@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=kuni1840@gmail.com \
--cc=kuniyu@google.com \
--cc=netdev@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox