* [PATCH bpf v3] bpf, sockmap: Fix self-redirect copied_seq double-counting
@ 2026-09-08 9:08 Geliang Tang
2026-09-09 4:37 ` Emil Tsalapatis
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Geliang Tang @ 2026-09-08 9:08 UTC (permalink / raw)
To: John Fastabend, Jakub Sitnicki, Jiayuan Chen, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Daniel Borkmann
Cc: Geliang Tang, netdev, bpf
From: Geliang Tang <tanggeliang@kylinos.cn>
When a BPF stream_verdict program redirects an skb back to the same
socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply()
calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the
skb is then delivered to the socket's psock ingress queue and later
read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via
the copied_from_self accounting path. This double-counting causes
copied_seq to advance by 2x the actual data length, triggering:
TCP recvmsg seq # bug 2: copied BF2E806, seq BF2E7FD, \
rcvnxt BF2E806, fl 0
WARNING: net/ipv4/tcp.c:2745 at tcp_recvmsg_locked+0x72b/0x2640
Call Trace:
tcp_recvmsg+0x10a/0x500
sock_recvmsg+0x168/0x1d0
__sys_recvfrom+0x19a/0x2a0
__x64_sys_recvfrom+0xe4/0x1f0
do_syscall_64+0xf7/0x530
entry_SYSCALL_64_after_hwframe+0x77/0x7f
cleanup rbuf bug: copied BF2E806 seq BF2E806 rcvnxt BF2E806
WARNING: net/ipv4/tcp.c:1609 at tcp_cleanup_rbuf+0xf2/0x1c0
Call Trace:
tcp_recvmsg_locked+0x8d1/0x2640
tcp_recvmsg+0x10a/0x500
sock_recvmsg+0x168/0x1d0
__sys_recvfrom+0x19a/0x2a0
__x64_sys_recvfrom+0xe4/0x1f0
do_syscall_64+0xf7/0x530
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fix this by converting self-redirect verdict to __SK_PASS at the
beginning of sk_psock_verdict_apply(). This bypasses the
__SK_REDIRECT case entirely (which calls sk_psock_eat_skb), letting
the __SK_PASS path queue the skb to the psock ingress queue. The
data is then read via tcp_bpf_recvmsg_parser(), which advances
copied_seq exactly once through copied_from_self. Cross-socket
redirects continue through __SK_REDIRECT with sk_psock_eat_skb()
unchanged.
Fixes: e5c6de5fa025 ("bpf, sockmap: Incorrectly handling copied_seq")
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Suggested-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
---
v3:
- add "bpf" prefix.
v2:
- fixup the verdict as Jakub and Jiayuan suggested.
- https://patchwork.kernel.org/project/netdevbpf/patch/1d2370f4c81f10834b8dd77524924575c629a464.1788591198.git.tanggeliang@kylinos.cn/
v1:
- https://patchwork.kernel.org/project/netdevbpf/patch/b840c35fdfdf36e9fddedfa645b12699bc51aa34.1787968065.git.tanggeliang@kylinos.cn/
---
net/core/skmsg.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 2521b643fa05..df385a5a961e 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -1000,6 +1000,10 @@ static int sk_psock_verdict_apply(struct sk_psock *psock, struct sk_buff *skb,
int err = 0;
u32 len, off;
+ if (verdict == __SK_REDIRECT && skb_bpf_ingress(skb) &&
+ skb_bpf_redirect_fetch(skb) == psock->sk)
+ verdict = __SK_PASS;
+
switch (verdict) {
case __SK_PASS:
err = -EIO;
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH bpf v3] bpf, sockmap: Fix self-redirect copied_seq double-counting
2026-09-08 9:08 [PATCH bpf v3] bpf, sockmap: Fix self-redirect copied_seq double-counting Geliang Tang
@ 2026-09-09 4:37 ` Emil Tsalapatis
2026-09-10 1:46 ` Jiayuan Chen
2026-09-14 5:00 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Emil Tsalapatis @ 2026-09-09 4:37 UTC (permalink / raw)
To: Geliang Tang
Cc: John Fastabend, Jakub Sitnicki, Jiayuan Chen, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Daniel Borkmann, Geliang Tang, netdev, bpf
On Tue, Sep 8, 2026 at 5:20 AM Geliang Tang <geliang@kernel.org> wrote:
>
> From: Geliang Tang <tanggeliang@kylinos.cn>
>
> When a BPF stream_verdict program redirects an skb back to the same
> socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply()
> calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the
> skb is then delivered to the socket's psock ingress queue and later
> read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via
> the copied_from_self accounting path. This double-counting causes
> copied_seq to advance by 2x the actual data length, triggering:
>
> TCP recvmsg seq # bug 2: copied BF2E806, seq BF2E7FD, \
> rcvnxt BF2E806, fl 0
> WARNING: net/ipv4/tcp.c:2745 at tcp_recvmsg_locked+0x72b/0x2640
> Call Trace:
> tcp_recvmsg+0x10a/0x500
> sock_recvmsg+0x168/0x1d0
> __sys_recvfrom+0x19a/0x2a0
> __x64_sys_recvfrom+0xe4/0x1f0
> do_syscall_64+0xf7/0x530
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> cleanup rbuf bug: copied BF2E806 seq BF2E806 rcvnxt BF2E806
> WARNING: net/ipv4/tcp.c:1609 at tcp_cleanup_rbuf+0xf2/0x1c0
> Call Trace:
> tcp_recvmsg_locked+0x8d1/0x2640
> tcp_recvmsg+0x10a/0x500
> sock_recvmsg+0x168/0x1d0
> __sys_recvfrom+0x19a/0x2a0
> __x64_sys_recvfrom+0xe4/0x1f0
> do_syscall_64+0xf7/0x530
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Fix this by converting self-redirect verdict to __SK_PASS at the
> beginning of sk_psock_verdict_apply(). This bypasses the
> __SK_REDIRECT case entirely (which calls sk_psock_eat_skb), letting
> the __SK_PASS path queue the skb to the psock ingress queue. The
> data is then read via tcp_bpf_recvmsg_parser(), which advances
> copied_seq exactly once through copied_from_self. Cross-socket
> redirects continue through __SK_REDIRECT with sk_psock_eat_skb()
> unchanged.
>
> Fixes: e5c6de5fa025 ("bpf, sockmap: Incorrectly handling copied_seq")
> Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
> Suggested-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Bot is wrong, in the sync path the whole ingress_bytes adjustment is so that
a later recvmsg will advance copied_seq by the amount of bytes we have in
psock after reading it. In the async path we just account for the data
immediately
in copied_seq and do not try to delay the accounting.
> ---
> v3:
> - add "bpf" prefix.
>
> v2:
> - fixup the verdict as Jakub and Jiayuan suggested.
> - https://patchwork.kernel.org/project/netdevbpf/patch/1d2370f4c81f10834b8dd77524924575c629a464.1788591198.git.tanggeliang@kylinos.cn/
>
> v1:
> - https://patchwork.kernel.org/project/netdevbpf/patch/b840c35fdfdf36e9fddedfa645b12699bc51aa34.1787968065.git.tanggeliang@kylinos.cn/
> ---
> net/core/skmsg.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/core/skmsg.c b/net/core/skmsg.c
> index 2521b643fa05..df385a5a961e 100644
> --- a/net/core/skmsg.c
> +++ b/net/core/skmsg.c
> @@ -1000,6 +1000,10 @@ static int sk_psock_verdict_apply(struct sk_psock *psock, struct sk_buff *skb,
> int err = 0;
> u32 len, off;
>
> + if (verdict == __SK_REDIRECT && skb_bpf_ingress(skb) &&
> + skb_bpf_redirect_fetch(skb) == psock->sk)
> + verdict = __SK_PASS;
> +
> switch (verdict) {
> case __SK_PASS:
> err = -EIO;
> --
> 2.53.0
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH bpf v3] bpf, sockmap: Fix self-redirect copied_seq double-counting
2026-09-08 9:08 [PATCH bpf v3] bpf, sockmap: Fix self-redirect copied_seq double-counting Geliang Tang
2026-09-09 4:37 ` Emil Tsalapatis
@ 2026-09-10 1:46 ` Jiayuan Chen
2026-09-14 5:00 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Jiayuan Chen @ 2026-09-10 1:46 UTC (permalink / raw)
To: Geliang Tang, John Fastabend, Jakub Sitnicki, Jiayuan Chen,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Daniel Borkmann
Cc: Geliang Tang, netdev, bpf
On 9/8/26 5:08 PM, Geliang Tang wrote:
> From: Geliang Tang <tanggeliang@kylinos.cn>
>
> When a BPF stream_verdict program redirects an skb back to the same
> socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply()
> calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the
> skb is then delivered to the socket's psock ingress queue and later
> read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via
> the copied_from_self accounting path. This double-counting causes
> copied_seq to advance by 2x the actual data length, triggering:
>
> TCP recvmsg seq # bug 2: copied BF2E806, seq BF2E7FD, \
> rcvnxt BF2E806, fl 0
> WARNING: net/ipv4/tcp.c:2745 at tcp_recvmsg_locked+0x72b/0x2640
> Call Trace:
> tcp_recvmsg+0x10a/0x500
> sock_recvmsg+0x168/0x1d0
> __sys_recvfrom+0x19a/0x2a0
> __x64_sys_recvfrom+0xe4/0x1f0
> do_syscall_64+0xf7/0x530
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> cleanup rbuf bug: copied BF2E806 seq BF2E806 rcvnxt BF2E806
> WARNING: net/ipv4/tcp.c:1609 at tcp_cleanup_rbuf+0xf2/0x1c0
> Call Trace:
> tcp_recvmsg_locked+0x8d1/0x2640
> tcp_recvmsg+0x10a/0x500
> sock_recvmsg+0x168/0x1d0
> __sys_recvfrom+0x19a/0x2a0
> __x64_sys_recvfrom+0xe4/0x1f0
> do_syscall_64+0xf7/0x530
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Fix this by converting self-redirect verdict to __SK_PASS at the
> beginning of sk_psock_verdict_apply(). This bypasses the
> __SK_REDIRECT case entirely (which calls sk_psock_eat_skb), letting
> the __SK_PASS path queue the skb to the psock ingress queue. The
> data is then read via tcp_bpf_recvmsg_parser(), which advances
> copied_seq exactly once through copied_from_self. Cross-socket
> redirects continue through __SK_REDIRECT with sk_psock_eat_skb()
> unchanged.
>
> Fixes: e5c6de5fa025 ("bpf, sockmap: Incorrectly handling copied_seq")
> Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
> Suggested-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
All AI reviews from BPF-CI and Sashiko go beyond the original meaning of
this patch.
> ---
> v3:
> - add "bpf" prefix.
>
> v2:
> - fixup the verdict as Jakub and Jiayuan suggested.
> - https://patchwork.kernel.org/project/netdevbpf/patch/1d2370f4c81f10834b8dd77524924575c629a464.1788591198.git.tanggeliang@kylinos.cn/
>
> v1:
> - https://patchwork.kernel.org/project/netdevbpf/patch/b840c35fdfdf36e9fddedfa645b12699bc51aa34.1787968065.git.tanggeliang@kylinos.cn/
> ---
> net/core/skmsg.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/net/core/skmsg.c b/net/core/skmsg.c
> index 2521b643fa05..df385a5a961e 100644
> --- a/net/core/skmsg.c
> +++ b/net/core/skmsg.c
> @@ -1000,6 +1000,10 @@ static int sk_psock_verdict_apply(struct sk_psock *psock, struct sk_buff *skb,
> int err = 0;
> u32 len, off;
>
> + if (verdict == __SK_REDIRECT && skb_bpf_ingress(skb) &&
> + skb_bpf_redirect_fetch(skb) == psock->sk)
> + verdict = __SK_PASS;
> +
> switch (verdict) {
> case __SK_PASS:
> err = -EIO;
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH bpf v3] bpf, sockmap: Fix self-redirect copied_seq double-counting
2026-09-08 9:08 [PATCH bpf v3] bpf, sockmap: Fix self-redirect copied_seq double-counting Geliang Tang
2026-09-09 4:37 ` Emil Tsalapatis
2026-09-10 1:46 ` Jiayuan Chen
@ 2026-09-14 5:00 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-09-14 5:00 UTC (permalink / raw)
To: Geliang Tang
Cc: john.fastabend, jakub, jiayuan.chen, davem, edumazet, kuba,
pabeni, horms, daniel, tanggeliang, netdev, bpf
Hello:
This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:
On Tue, 8 Sep 2026 17:08:32 +0800 you wrote:
> From: Geliang Tang <tanggeliang@kylinos.cn>
>
> When a BPF stream_verdict program redirects an skb back to the same
> socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply()
> calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the
> skb is then delivered to the socket's psock ingress queue and later
> read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via
> the copied_from_self accounting path. This double-counting causes
> copied_seq to advance by 2x the actual data length, triggering:
>
> [...]
Here is the summary with links:
- [bpf,v3] bpf, sockmap: Fix self-redirect copied_seq double-counting
https://git.kernel.org/bpf/bpf/c/490a83d6386e
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-14 5:01 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-08 9:08 [PATCH bpf v3] bpf, sockmap: Fix self-redirect copied_seq double-counting Geliang Tang
2026-09-09 4:37 ` Emil Tsalapatis
2026-09-10 1:46 ` Jiayuan Chen
2026-09-14 5:00 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).