[PATCH bpf 0/2] bpf, sockmap: Fix dropped data and EPIPE on empty skb redirect

[Eli Skeggs via B4 Relay]

When a socket receives a bare FIN, tcp_read_skb() hands an empty skb to
the attached BPF stream_verdict program. The program may redirect that
skb to another socket. Doing so causes the target socket to report EPIPE
and stop transmitting redirected data. A proxy may see the erroneous
EPIPE and truncate a half-closed connection. Instead of treating a
redirected empty skb as an error, treat a 0 return as an error only when
there is more data to send.

Patch 2 adds a selftest that fails without patch 1.

Tested on x86_64 with virtme-ng, under QEMU without KVM. The new subtest
fails on bpf/master without patch 1, and passes with it. The full
test_progs -t sockmap passes all seven tests and 802 subtests with patch
1.

The bug dates from v6.0 (965b57b469a5), so please consider queueing
patch 1 for stable.

Found while building a sockmap proxy between TCP and MPTCP sockets,
running out-of-tree MPTCP sockmap patches, where the EPIPE caused
half-closed connections to prematurely abort. An LLM helped locate and
reproduce the issue, and proposed an initial fix. I traced the code
path, reviewed and verified the LLM-written test, and simplified its
proposal to a one-line fix.

Signed-off-by: Eli Skeggs <kernel@xxxxxxxxxxxxx>
---
Eli Skeggs (2):
      bpf, sockmap: Stop reporting EPIPE on zero-length skb redirect
      selftests/bpf: Redirect a bare FIN to another socket's egress

 net/core/skmsg.c                                   |  2 +-
 .../selftests/bpf/prog_tests/sockmap_basic.c       | 74 ++++++++++++++++++++++
 .../selftests/bpf/progs/test_sockmap_pass_prog.c   |  8 +++
 3 files changed, 83 insertions(+), 1 deletion(-)
---
base-commit: f909e534f5e34feb2ea2701d54df63e21aa506fc
change-id: 20261020-sockmap-bare-fin-e1f8160c3c7b

Best regards,
--  
Eli Skeggs <kernel@xxxxxxxxxxxxx>