Re: [PATCH bpf-next v2] bpf, sockmap: Fix psock incorrectly pointing to sk

[John Fastabend]

On 2025-06-09 10:59:08, Jiayuan Chen wrote:
> We observed an issue from the latest selftest: sockmap_redir where
> sk_psock(psock->sk) != psock in the backlog. The root cause is the special
> behavior in sockmap_redir - it frequently performs map_update() and
> map_delete() on the same socket. During map_update(), we create a new
> psock and during map_delete(), we eventually free the psock via rcu_work
> in sk_psock_drop(). However, pending workqueues might still exist and not
> be processed yet. If users immediately perform another map_update(), a new
> psock will be allocated for the same sk, resulting in two psocks pointing
> to the same sk.
> 
> When the pending workqueue is later triggered, it uses the old psock to
> access sk for I/O operations, which is incorrect.

[...]

> 
> Note: We cannot call cancel_delayed_work_sync() in map_delete() since this
> might be invoked in BPF context by BPF helper, and the function may sleep.
> 
> Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
> Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
> 
> ---
> V1->V2: Use existing flag instead of adding new one.
> https://lore.kernel.org/bpf/20250605142448.3llri3w7wbclfxwc@xxxxxxxxx/
> 
> Thanks to Michal Luczaj for providing the sockmap_redir test case, which
> indeed covers almost all sockmap forwarding paths.
> ---
>  net/core/skmsg.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 

Reviewed-by: John Fastabend <john.fastabend@xxxxxxxxx>