Files
linux-stable-mirror/include/linux
Jiayuan Chen a20abfa524 bpf, sockmap: Fix incorrect copied_seq calculation
[ Upstream commit b40cc5adaa ]

A socket using sockmap has its own independent receive queue: ingress_msg.
This queue may contain data from its own protocol stack or from other
sockets.

The issue is that when reading from ingress_msg, we update tp->copied_seq
by default. However, if the data is not from its own protocol stack,
tcp->rcv_nxt is not increased. Later, if we convert this socket to a
native socket, reading from this socket may fail because copied_seq might
be significantly larger than rcv_nxt.

This fix also addresses the syzkaller-reported bug referenced in the
Closes tag.

This patch marks the skmsg objects in ingress_msg. When reading, we update
copied_seq only if the data is from its own protocol stack.

                                                     FD1:read()
                                                     --  FD1->copied_seq++
                                                         |  [read data]
                                                         |
                                [enqueue data]           v
                  [sockmap]     -> ingress to self ->  ingress_msg queue
FD1 native stack  ------>                                 ^
-- FD1->rcv_nxt++               -> redirect to other      | [enqueue data]
                                       |                  |
                                       |             ingress to FD1
                                       v                  ^
                                      ...                 |  [sockmap]
                                                     FD2 native stack

Closes: https://syzkaller.appspot.com/bug?extid=06dbd397158ec0ea4983
Fixes: 04919bed94 ("tcp: Introduce tcp_read_skb()")
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://lore.kernel.org/r/20260124113314.113584-2-jiayuan.chen@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2026-03-04 07:19:29 -05:00
..
2024-06-12 11:03:08 +02:00
2024-07-05 09:31:59 +02:00
2025-09-11 17:19:15 +02:00
2024-12-14 19:53:51 +01:00
2024-10-17 15:21:32 +02:00
2024-12-14 19:54:37 +01:00
2026-01-11 15:19:01 +01:00
2025-07-06 10:58:04 +02:00
2026-01-11 15:18:35 +01:00
2025-06-04 14:40:25 +02:00
2025-08-15 12:04:54 +02:00
2024-06-12 11:03:21 +02:00
2026-01-11 15:18:48 +01:00
2025-02-01 18:30:05 +01:00
2026-01-11 15:19:13 +01:00
2024-10-17 15:21:12 +02:00