Re: [PATCH v2 bpf/net 2/6] sockmap: Annotate sk->sk_write_space() for UDP.
From: bot+bpf-ci@kernel.org
Date: 2026-02-17 00:35:25
Also in:
bpf
quoted hunk ↗ jump to hunk
diff --git a/net/core/sock.c b/net/core/sock.c --- a/net/core/sock.c +++ b/net/core/sock.c@@ -2673,8 +2673,12 @@ void sock_wfree(struct sk_buff *skb) int old; if (!sock_flag(sk, SOCK_USE_WRITE_QUEUE)) { + void (*sk_write_space)(struct sock *sk); + + sk_write_space = READ_ONCE(sk->sk_write_space);
With the reader now using READ_ONCE(), should the restore path
in udp_bpf_update_proto() also use WRITE_ONCE()?
net/ipv4/udp_bpf.c:udp_bpf_update_proto() {
if (restore) {
sk->sk_write_space = psock->saved_write_space;
...
}
}
This plain store can race with sock_wfree() reading
sk->sk_write_space via:
sk_psock_drop()
-> sk_psock_restore_proto()
-> udp_bpf_update_proto(sk, psock, true)
The caller holds write_lock_bh(&sk->sk_callback_lock), but
sock_wfree() does not hold that lock.
This was raised during v1 review:
https://lore.kernel.org/bpf/4fa31330c83ad1ab8e4498d2c92dbd4e7660d90bf162395c19bc7bfa7e38b70c@mail.kernel.org/ (local)
+
+ if (sock_flag(sk, SOCK_RCU_FREE) &&
+ sk_write_space == sock_def_write_space) {[ ... ] --- AI reviewed your patch. Please fix the bug or email reply why it's not a bug. See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md CI run summary: https://github.com/kernel-patches/bpf/actions/runs/22081407735 AI-authorship-score: low AI-authorship-explanation: The commit is a small, focused data race annotation fix consistent with the author's established kernel networking contributions and standard kernel style. issues-found: 1 issue-severity-score: low issue-severity-explanation: Incomplete data race annotation leaves the udp_bpf_update_proto() restore path with a plain store to sk->sk_write_space that can race with the new READ_ONCE in sock_wfree(), though the practical impact is limited to KCSAN warnings.