On 2025-06-09 10:59:08, Jiayuan Chen wrote:
> We observed an issue from the latest selftest: sockmap_redir where
> sk_psock(psock->sk) != psock in the backlog. The root cause is the special
> behavior in sockmap_redir - it frequently performs map_update() and
> map_delete() on the same socket. During map_update(), we create a new
> psock and during map_delete(), we eventually free the psock via rcu_work
> in sk_psock_drop(). However, pending workqueues might still exist and not
> be processed yet. If users immediately perform another map_update(), a new
> psock will be allocated for the same sk, resulting in two psocks pointing
> to the same sk.
>
> When the pending workqueue is later triggered, it uses the old psock to
> access sk for I/O operations, which is incorrect.
[...]
>
> Note: We cannot call cancel_delayed_work_sync() in map_delete() since this
> might be invoked in BPF context by BPF helper, and the function may sleep.
>
> Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
> Signed-off-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
>
> ---
> V1->V2: Use existing flag instead of adding new one.
> https://lore.kernel.org/bpf/20250605142448.3llri3w7wbclfxwc@xxxxxxxxx/
>
> Thanks to Michal Luczaj for providing the sockmap_redir test case, which
> indeed covers almost all sockmap forwarding paths.
> ---
> net/core/skmsg.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
Reviewed-by: John Fastabend <john.fastabend@xxxxxxxxx>
