[PATCH] bpf, sockmap: Propagate sk_msg_memcopy_from_iter error code

[PATCH] bpf, sockmap: Propagate sk_msg_memcopy_from_iter error code

[Rui Qi]

tcp_bpf_sendmsg() stores the return value of sk_msg_memcopy_from_iter()
in a local variable "ret" and jumps to out_err on failure, but never
copies that value into "err".  The "err" variable therefore keeps
whatever it held before the copy: 0 on the normal allocation path, or
the stale -ENOSPC left behind by a partial sk_msg_alloc().

On the first loop iteration "copied" is still 0, so the function
returns "copied > 0 ? copied : err" -- 0 on the normal path and the
stale -ENOSPC on the partial-allocation path -- instead of the real
error such as -EFAULT.  A blocking sendmsg() handed data but returning
0 with no errno can drive userspace into a busy retry loop or be taken
for a successful short write, and the wrong errno misleads recovery on
the other path.

Propagate the memcopy failure so the real errno reaches userspace,
consistent with every other out_err path in the function.

Fixes: 5153a75ef34b ("tcp_bpf: Fix copied value in tcp_bpf_sendmsg")
Signed-off-by: Rui Qi <qirui.001@bytedance.com>
---
 net/ipv4/tcp_bpf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index 97541acb3cce..8cf63a9e7fed 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -578,6 +578,7 @@ static int tcp_bpf_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 					       copy);
 		if (ret < 0) {
 			sk_msg_trim(sk, msg_tx, osize);
+			err = ret;
 			goto out_err;
 		}
 
-- 
2.20.1

Re: [PATCH] bpf, sockmap: Propagate sk_msg_memcopy_from_iter error code

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] bpf, sockmap: Propagate sk_msg_memcopy_from_iter error code

[Jiayuan Chen]

On 10/22/26 5:58 PM, Rui Qi wrote:
> tcp_bpf_sendmsg() stores the return value of sk_msg_memcopy_from_iter()
> in a local variable "ret" and jumps to out_err on failure, but never
> copies that value into "err".  The "err" variable therefore keeps
> whatever it held before the copy: 0 on the normal allocation path, or
> the stale -ENOSPC left behind by a partial sk_msg_alloc().
>
> On the first loop iteration "copied" is still 0, so the function
> returns "copied > 0 ? copied : err" -- 0 on the normal path and the
> stale -ENOSPC on the partial-allocation path -- instead of the real
> error such as -EFAULT.  A blocking sendmsg() handed data but returning
> 0 with no errno can drive userspace into a busy retry loop or be taken
> for a successful short write, and the wrong errno misleads recovery on
> the other path.
>
> Propagate the memcopy failure so the real errno reaches userspace,
> consistent with every other out_err path in the function.
>
> Fixes: 5153a75ef34b ("tcp_bpf: Fix copied value in tcp_bpf_sendmsg")
> Signed-off-by: Rui Qi <qirui.001@bytedance.com>
> ---
>   net/ipv4/tcp_bpf.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
> index 97541acb3cce..8cf63a9e7fed 100644
> --- a/net/ipv4/tcp_bpf.c
> +++ b/net/ipv4/tcp_bpf.c
> @@ -578,6 +578,7 @@ static int tcp_bpf_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
>   					       copy);
>   		if (ret < 0) {
>   			sk_msg_trim(sk, msg_tx, osize);
> +			err = ret;
>   			goto out_err;
>   		}
>   


Thanks for your report but it has been fixed.

https://lore.kernel.org/netdev/20261019082214.102398-1-dmantipov@yandex.ru/


pw-bot: cr