[PATCH v2 bpf/net 5/6] sockmap: Consolidate sk_psock_skb_ingress_self().
From: Kuniyuki Iwashima <kuniyu@google.com>
Date: 2026-02-17 00:07:13
Also in:
bpf
Subsystem:
bpf [l7 framework] (sockmap), networking [general], the rest · Maintainers:
John Fastabend, Jakub Sitnicki, Jiayuan Chen, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
SOCKMAP memory accounting for UDP is broken, and sk_psock_skb_ingress_self() should not be used for UDP. Let's consolidate sk_psock_skb_ingress_self() to sk_psock_skb_ingress() so we can centralise the fix. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> --- v2: Keep msg->sk assignment --- net/core/skmsg.c | 62 ++++++++++++++---------------------------------- 1 file changed, 18 insertions(+), 44 deletions(-)
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 57845b0d8a71..6bf3c517dbd2 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c@@ -572,32 +572,31 @@ static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb, return copied; } -static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb, - u32 off, u32 len, bool take_ref); - static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb, - u32 off, u32 len, gfp_t gfp_flags) + u32 off, u32 len, gfp_t gfp_flags, bool take_ref) { struct sock *sk = psock->sk; struct sk_msg *msg; int err = -EAGAIN; - /* If we are receiving on the same sock skb->sk is already assigned, - * skip memory accounting and owner transition seeing it already set - * correctly. - */ - if (unlikely(skb->sk == sk)) - return sk_psock_skb_ingress_self(psock, skb, off, len, true); - msg = alloc_sk_msg(gfp_flags); if (!msg) goto out; - if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) - goto free; + if (skb->sk != sk) { + if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf) + goto free; - if (!sk_rmem_schedule(sk, skb, skb->truesize)) - goto free; + if (!sk_rmem_schedule(sk, skb, skb->truesize)) + goto free; + } + + /* This is used in tcp_bpf_recvmsg_parser() to determine whether the + * data originates from the socket's own protocol stack. No need to + * refcount sk because msg's lifetime is bound to sk via the ingress_msg. + */ + if (skb->sk == sk || !take_ref) + msg->sk = sk; /* This will transition ownership of the data from the socket where * the BPF program was run initiating the redirect to the socket
@@ -606,7 +605,8 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb, * into user buffers. */ skb_set_owner_r(skb, sk); - err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg, true); + + err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg, take_ref); if (err < 0) goto free; out:
@@ -616,32 +616,6 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb, goto out; } -/* Puts an skb on the ingress queue of the socket already assigned to the - * skb. In this case we do not need to check memory limits or skb_set_owner_r - * because the skb is already accounted for here. - */ -static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb, - u32 off, u32 len, bool take_ref) -{ - struct sk_msg *msg = alloc_sk_msg(GFP_ATOMIC); - struct sock *sk = psock->sk; - int err; - - if (unlikely(!msg)) - return -EAGAIN; - skb_set_owner_r(skb, sk); - - /* This is used in tcp_bpf_recvmsg_parser() to determine whether the - * data originates from the socket's own protocol stack. No need to - * refcount sk because msg's lifetime is bound to sk via the ingress_msg. - */ - msg->sk = sk; - err = sk_psock_skb_ingress_enqueue(skb, off, len, psock, sk, msg, take_ref); - if (err < 0) - kfree(msg); - return err; -} - static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb, u32 off, u32 len, bool ingress) {
@@ -651,7 +625,7 @@ static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb, return skb_send_sock(psock->sk, skb, off, len); } - return sk_psock_skb_ingress(psock, skb, off, len, GFP_KERNEL); + return sk_psock_skb_ingress(psock, skb, off, len, GFP_KERNEL, true); } static void sk_psock_skb_state(struct sk_psock *psock,
@@ -1058,7 +1032,7 @@ static int sk_psock_verdict_apply(struct sk_psock *psock, struct sk_buff *skb, off = stm->offset; len = stm->full_len; } - err = sk_psock_skb_ingress_self(psock, skb, off, len, false); + err = sk_psock_skb_ingress(psock, skb, off, len, GFP_ATOMIC, false); } if (err < 0) { spin_lock_bh(&psock->ingress_lock);
--
2.53.0.310.g728cabbaf7-goog