[PATCH] bpf, sockmap: Propagate sk_msg_memcopy_from_iter error code

[Rui Qi]

tcp_bpf_sendmsg() stores the return value of sk_msg_memcopy_from_iter()
in a local variable "ret" and jumps to out_err on failure, but never
copies that value into "err".  The "err" variable therefore keeps
whatever it held before the copy: 0 on the normal allocation path, or
the stale -ENOSPC left behind by a partial sk_msg_alloc().

On the first loop iteration "copied" is still 0, so the function
returns "copied > 0 ? copied : err" -- 0 on the normal path and the
stale -ENOSPC on the partial-allocation path -- instead of the real
error such as -EFAULT.  A blocking sendmsg() handed data but returning
0 with no errno can drive userspace into a busy retry loop or be taken
for a successful short write, and the wrong errno misleads recovery on
the other path.

Propagate the memcopy failure so the real errno reaches userspace,
consistent with every other out_err path in the function.

Fixes: 5153a75ef34b ("tcp_bpf: Fix copied value in tcp_bpf_sendmsg")
Signed-off-by: Rui Qi <qirui.001@xxxxxxxxxxxxx>
---
 net/ipv4/tcp_bpf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index 97541acb3cce..8cf63a9e7fed 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -578,6 +578,7 @@ static int tcp_bpf_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 					       copy);
 		if (ret < 0) {
 			sk_msg_trim(sk, msg_tx, osize);
+			err = ret;
 			goto out_err;
 		}
 
-- 
2.20.1