public inbox for netdev@vger.kernel.org
 help / color / mirror / Atom feed
From: Martin KaFai Lau <martin.lau@linux.dev>
To: Kuniyuki Iwashima <kuniyu@google.com>,
	Jiayuan Chen <jiayuan.chen@linux.dev>
Cc: John Fastabend <john.fastabend@gmail.com>,
	Jakub Sitnicki <jakub@cloudflare.com>,
	Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
	Kuniyuki Iwashima <kuni1840@gmail.com>,
	bpf@vger.kernel.org, netdev@vger.kernel.org
Subject: Re: [PATCH v4 bpf/net 2/6] sockmap: Annotate sk->sk_write_space() for UDP.
Date: Fri, 6 Mar 2026 16:03:47 -0800	[thread overview]
Message-ID: <dc3a8b4c-32f3-4905-8cca-078f220abfef@linux.dev> (raw)
In-Reply-To: <CAAVpQUAJgFtcJGtuMufS9mhaShs7OQDxx7jTGOSbG9wCdeCN7Q@mail.gmail.com>



On 3/4/26 7:43 PM, Kuniyuki Iwashima wrote:
> On Wed, Mar 4, 2026 at 5:48 PM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>>
>> On Sat, Feb 21, 2026 at 11:30:49PM +0800, Kuniyuki Iwashima wrote:
>>> UDP TX skb->destructor() is sock_wfree(), and UDP only
>>> holds lock_sock() for UDP_CORK / MSG_MORE sendmsg().
>>>
>>> Otherwise, sk->sk_write_space() is read locklessly.
>>>
>>> Let's use WRITE_ONCE() and READ_ONCE() for sk->sk_write_space().
>>>
>>> Fixes: 7b98cd42b049 ("bpf: sockmap: Add UDP support")
>>> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
>>> ---
>>> v3: Use WRITE_ONCE() in udp_bpf_update_proto()
>>> v2: Cache sk->sk_write_space in sock_wfree()
>>> ---
>>>   net/core/skmsg.c   | 2 +-
>>>   net/core/sock.c    | 8 ++++++--
>>>   net/ipv4/udp_bpf.c | 2 +-
>>>   3 files changed, 8 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/net/core/skmsg.c b/net/core/skmsg.c
>>> index 75fa94217e1e..3d7eb2f4ac98 100644
>>> --- a/net/core/skmsg.c
>>> +++ b/net/core/skmsg.c
>>> @@ -1297,7 +1297,7 @@ void sk_psock_start_verdict(struct sock *sk, struct sk_psock *psock)
>>>
>>>        psock->saved_data_ready = sk->sk_data_ready;
>>>        WRITE_ONCE(sk->sk_data_ready, sk_psock_verdict_data_ready);
>>> -     sk->sk_write_space = sk_psock_write_space;
>>> +     WRITE_ONCE(sk->sk_write_space, sk_psock_write_space);
>>>   }
>>
>> I noticed that Patch 1 and 2 were submitted earlier and are on bpf tree.
>> Given that Eric's commit (which you reviewed) is now in net.git, these two patches
>> should probably be dropped in the next version, right? Just confirming.
> 
> I was thinking git can just handle them well, and even the
> patch 2 has a delta in sock_wfree().

At least for patch 1, I am not sure git can handle it well without human 
intervention because the sk_write_space is backward from Eric.

For the missing change in sock_wfree (?), it probably makes sense to 
create a separate patch on top of Eric's change and target net. My 
understanding is patch 3-6 can be on its own without patch 1+2.


  reply	other threads:[~2026-03-07  0:04 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-02-21 23:30 [PATCH v4 bpf/net 0/6] sockmap: Fix UAF and broken memory accounting for UDP Kuniyuki Iwashima
2026-02-21 23:30 ` [PATCH v4 bpf/net 1/6] sockmap: Annotate sk->sk_data_ready() " Kuniyuki Iwashima
2026-03-05 11:05   ` Jakub Sitnicki
2026-03-05 11:27   ` Jiayuan Chen
2026-02-21 23:30 ` [PATCH v4 bpf/net 2/6] sockmap: Annotate sk->sk_write_space() " Kuniyuki Iwashima
2026-03-05  1:48   ` Jiayuan Chen
2026-03-05  3:43     ` Kuniyuki Iwashima
2026-03-07  0:03       ` Martin KaFai Lau [this message]
2026-03-07  2:51         ` Kuniyuki Iwashima
2026-03-05 11:35   ` Jiayuan Chen
2026-03-05 11:51   ` Jakub Sitnicki
2026-02-21 23:30 ` [PATCH v4 bpf/net 3/6] sockmap: Fix use-after-free in udp_bpf_recvmsg() Kuniyuki Iwashima
2026-03-05  2:30   ` Jiayuan Chen
2026-03-05  3:41     ` Kuniyuki Iwashima
2026-03-05 11:36   ` Jiayuan Chen
2026-03-05 11:39   ` Jakub Sitnicki
2026-03-05 17:46     ` Kuniyuki Iwashima
2026-02-21 23:30 ` [PATCH v4 bpf/net 4/6] sockmap: Inline sk_psock_create_ingress_msg() Kuniyuki Iwashima
2026-03-05 11:44   ` Jakub Sitnicki
2026-02-21 23:30 ` [PATCH v4 bpf/net 5/6] sockmap: Consolidate sk_psock_skb_ingress_self() Kuniyuki Iwashima
2026-02-21 23:30 ` [PATCH v4 bpf/net 6/6] sockmap: Fix broken memory accounting for UDP Kuniyuki Iwashima
2026-03-04 20:04   ` Martin KaFai Lau
2026-03-04 20:14     ` Kuniyuki Iwashima
2026-03-05  6:37   ` Jiayuan Chen
2026-03-05  7:48     ` Kuniyuki Iwashima
2026-03-05  8:30       ` Jiayuan Chen
2026-03-05  9:27         ` Kuniyuki Iwashima
2026-03-05 10:45           ` Jiayuan Chen
2026-03-05 11:04             ` Jiayuan Chen
2026-03-05 17:42               ` Kuniyuki Iwashima
2026-03-06  7:44                 ` Jiayuan Chen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=dc3a8b4c-32f3-4905-8cca-078f220abfef@linux.dev \
    --to=martin.lau@linux.dev \
    --cc=bpf@vger.kernel.org \
    --cc=jakub@cloudflare.com \
    --cc=jiayuan.chen@linux.dev \
    --cc=john.fastabend@gmail.com \
    --cc=kuni1840@gmail.com \
    --cc=kuniyu@google.com \
    --cc=netdev@vger.kernel.org \
    --cc=willemdebruijn.kernel@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox