• John Fastabend's avatar
    bpf: sockmap, decrement copied count correctly in redirect error case · 501ca817
    John Fastabend authored
    Currently, when a redirect occurs in sockmap and an error occurs in
    the redirect call we unwind the scatterlist once in the error path
    of bpf_tcp_sendmsg_do_redirect() and then again in sendmsg(). Then
    in the error path of sendmsg we decrement the copied count by the
    send size.
    
    However, its possible we partially sent data before the error was
    generated. This can happen if do_tcp_sendpages() partially sends the
    scatterlist before encountering a memory pressure error. If this
    happens we need to decrement the copied value (the value tracking
    how many bytes were actually sent to TCP stack) by the number of
    remaining bytes _not_ the entire send size. Otherwise we risk
    confusing userspace.
    
    Also we don't need two calls to free the scatterlist one is
    good enough. So remove the one in bpf_tcp_sendmsg_do_redirect() and
    then properly reduce copied by the number of remaining bytes which
    may in fact be the entire send size if no bytes were sent.
    
    To do this use bool to indicate if free_start_sg() should do mem
    accounting or not.
    Signed-off-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    501ca817
sockmap.c 59.9 KB