[PATCH net 1/1] tcp_bpf: sync copied_seq after pre-accept data

In tcp_bpf_recvmsg_parser(), copied_seq is saved before tcp_data_ready()
processes data queued before accept(). The sockmap verdict path can
consume, drop, or redirect that data and advance tcp->copied_seq. The
parser later writes back a value based on its stale snapshot, rewinding
the sequence past data no longer present in the receive queue.

Refresh the local sequence from tcp->copied_seq after tcp_data_ready()
processes the pre-accept queue. This preserves progress made by the
sockmap path, including when the receive queue could not be fully drained.

Fixes: e5c6de5fa025 ("bpf, sockmap: Incorrectly handling copied_seq")
Cc: <redacted>
Reported-by: Vega <redacted>
Link: https://sashiko.dev/#/patchset/20260630205043.184894-1-rhkrqnwk98@gmail.com
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260630205043.184894-1-rhkrqnwk98@gmail.com
Assisted-by: LLM
Signed-off-by: Zhiling Zou <redacted>
---
 net/ipv4/tcp_bpf.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index 0ce583f68d3b7..383ee167eb300 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c

@@ -252,6 +252,10 @@ static int tcp_bpf_recvmsg_parser(struct sock *sk,
 	 */
 	if (unlikely(!skb_queue_empty(&sk->sk_receive_queue))) {
 		tcp_data_ready(sk);
+		/* tcp_data_ready() may have consumed or redirected data and
+		 * advanced copied_seq.
+		 */
+		seq = tcp->copied_seq;
 		/* This handles the ENOMEM errors if we both receive data
 		 * pre accept and are already under memory pressure. At least
 		 * let user know to retry.

-- 
2.55.0