Re: [PATCH] bpf, sockmap: Propagate sk_msg_memcopy_from_iter error code

[Jiayuan Chen]

On 10/22/26 5:58 PM, Rui Qi wrote:
> tcp_bpf_sendmsg() stores the return value of sk_msg_memcopy_from_iter()
> in a local variable "ret" and jumps to out_err on failure, but never
> copies that value into "err".  The "err" variable therefore keeps
> whatever it held before the copy: 0 on the normal allocation path, or
> the stale -ENOSPC left behind by a partial sk_msg_alloc().
>
> On the first loop iteration "copied" is still 0, so the function
> returns "copied > 0 ? copied : err" -- 0 on the normal path and the
> stale -ENOSPC on the partial-allocation path -- instead of the real
> error such as -EFAULT.  A blocking sendmsg() handed data but returning
> 0 with no errno can drive userspace into a busy retry loop or be taken
> for a successful short write, and the wrong errno misleads recovery on
> the other path.
>
> Propagate the memcopy failure so the real errno reaches userspace,
> consistent with every other out_err path in the function.
>
> Fixes: 5153a75ef34b ("tcp_bpf: Fix copied value in tcp_bpf_sendmsg")
> Signed-off-by: Rui Qi <qirui.001@xxxxxxxxxxxxx>
> ---
>   net/ipv4/tcp_bpf.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
> index 97541acb3cce..8cf63a9e7fed 100644
> --- a/net/ipv4/tcp_bpf.c
> +++ b/net/ipv4/tcp_bpf.c
> @@ -578,6 +578,7 @@ static int tcp_bpf_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
>   					       copy);
>   		if (ret < 0) {
>   			sk_msg_trim(sk, msg_tx, osize);
> +			err = ret;
>   			goto out_err;
>   		}
>   


Thanks for your report but it has been fixed.

https://lore.kernel.org/netdev/20261019082214.102398-1-dmantipov@xxxxxxxxx/


pw-bot: cr