Skip to content

bpf, sockmap: fix forward allocation accounting in strparser self-pass path - #8576

Open
kernel-patches-daemon-bpf-rc[bot] wants to merge 2 commits into
bpf_basefrom
series/1138595=>bpf
Open

bpf, sockmap: fix forward allocation accounting in strparser self-pass path#8576
kernel-patches-daemon-bpf-rc[bot] wants to merge 2 commits into
bpf_basefrom
series/1138595=>bpf

Conversation

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown

Pull request for series with
subject: bpf, sockmap: fix forward allocation accounting in strparser self-pass path
version: 2
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1138595

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: 80f3c3e
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1138595
version: 2

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: a766247
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1138595
version: 2

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: fdeba03
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1138595
version: 2

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: e5fd3f5
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1138595
version: 2

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: 7cd8645
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1138595
version: 2

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: 31a420a
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1138595
version: 2

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: 31a420a
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1138595
version: 2

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: 7a3c028
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1138595
version: 2

ZirAjs added 2 commits August 7, 2026 08:37
The strparser SK_PASS path can queue cloned skbs back to the same
socket. A single TCP receive skb may be split into multiple strparser
messages, and each cloned message still carries the receive owner from
the TCP receive path.

sk_psock_skb_ingress_self() reassigns receive ownership with
skb_set_owner_r(). That first orphans the skb, which runs the existing
receive destructor, and then charges the skb to the socket again. When
this is repeated for strparser clones, sk_forward_alloc can already be
in deficit before the next owner transition. Releasing the queued skbs
can then uncharge more memcg pages than were reserved and trigger a
page_counter underflow.

Call sk_rmem_schedule() with a size of zero before skb_set_owner_r()
for strparser self-pass skbs. Use the zero-sized reservation to top up
any existing sk_forward_alloc deficit without reserving the skb's full
truesize again, then let skb_set_owner_r() perform the receive-owner
transition. Apply the same handling when retrying the skb from the psock
backlog.

Fixes: 144748e ("bpf, sockmap: Fix incorrect fwd_alloc accounting")
Reported-by: Sechang Lim <rhkrqnwk98@gmail.com>
Suggested-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Junseo Lim <zirajs7@gmail.com>
Add a sockmap_strp regression test for strparser SK_PASS delivery to the
same socket. A one-byte stream parser splits a single write into many
messages, repeatedly exercising receive ownership transitions while the
skbs remain queued.

Verify through INET_DIAG_MEMINFO that sk_forward_alloc does not become
negative after the self-pass path is exercised.

Signed-off-by: Junseo Lim <zirajs7@gmail.com>
@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: a13307e
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1138595
version: 2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant