Re: [PATCH bpf-next v5 0/3] bpf, sockmap: reject a packet-modifying SK_SKB stream parser

[Ihor Solodrai]

On 2026-06-19 7:44 p.m., Sechang Lim wrote:
> A BPF_PROG_TYPE_SK_SKB stream parser runs on strparser's message head,
> which can chain skbs through frag_list. A parser that resizes the skb
> frees the frag_list segments that strparser still tracks through
> skb_nextp, leading to a use-after-free.
>
> A stream parser is only meant to measure the next message, not to modify
> the packet, so reject a packet-modifying parser at attach time.
>
> v5:
>   - target bpf-next instead of bpf
>   - add Reviewed-by tag (Jiayuan Chen)
>
> v4:
>   - https://lore.kernel.org/all/20260619062959.3277612-1-rhkrqnwk98@xxxxxxxxx/
>
> v3:
>   - https://lore.kernel.org/all/20260618102718.2331468-1-rhkrqnwk98@xxxxxxxxx/
>
> v2:
>   - https://lore.kernel.org/all/20260612123553.2724240-1-rhkrqnwk98@xxxxxxxxx/
>
> v1:
>   - https://lore.kernel.org/all/20260609112316.3685738-1-rhkrqnwk98@xxxxxxxxx/
>
> Sechang Lim (3):
>    selftests/bpf: don't modify the skb in the strparser parser prog
>    bpf, sockmap: reject a packet-modifying SK_SKB stream parser
>    selftests/bpf: test rejection of a packet-modifying SK_SKB stream
>      parser


Hi Sechang, all,

This series broke test_maps (test_sockmap subtest) on the bpf
tree. Currently on BPF CI the test fails on bpf, but passes on
bpf-next (it doesn't have the series yet).

test_maps fails with:

    + taskset 0xF ./test_maps
    [    8.352378] clocksource: Watchdog remote CPU 2 read timed out
    Failed sockmap unexpected timeout

See test_maps.c:995 in test_sockmap(): the 30s select() times out and
test_maps exits 1. Note there is no "Failed stream parser bpf prog
attach" message, the parser attaches fine.

The series was merged into bpf on 2026-06-26 00:42 UTC

CI runs:
  last good (pre-merge, 06-25): 
https://github.com/kernel-patches/bpf/actions/runs/28158326456
  first bad (post-merge, 06-26): 
https://github.com/kernel-patches/bpf/actions/runs/28210181858
  recent bad (06-30): 
https://github.com/kernel-patches/bpf/actions/runs/28475936023

Confirmed locally reverting the 3 commits and rebuilding makes
test_sockmap pass again.

Could you please help investigate?

Thanks!


>   net/core/sock_map.c                           | 20 ++++++++++++
>   .../selftests/bpf/prog_tests/sockmap_strp.c   | 31 +++++++++++++++++++
>   .../selftests/bpf/progs/sockmap_parse_prog.c  | 22 -------------
>   .../selftests/bpf/progs/test_sockmap_strp.c   |  7 +++++
>   4 files changed, 58 insertions(+), 22 deletions(-)