bpf, sockmap: fix duplicated data transmission

In the !ingress path under sk_psock_handle_skb(), when sending data to the
remote under snd_buf limitations, partial skb data might be transmitted.

Although we preserved the partial transmission state (offset/length), the
state wasn't properly consumed during retries. This caused the retry path
to resend the entire skb data instead of continuing from the previous
offset, resulting in data overlap at the receiver side.

Fixes: 405df89dd52c ("bpf, sockmap: Improved check for empty queue")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://lore.kernel.org/r/20250407142234.47591-3-jiayuan.chen@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 29cb5ffd56c0bfaed025be79ed142aa959526a3c..9533b3e40ad7920cab86e1a620a14ce96df044d5 100644 (file)
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -656,11 +656,6 @@ static void sk_psock_backlog(struct work_struct *work)
        int ret;
 
        mutex_lock(&psock->work_mutex);
-       if (unlikely(state->len)) {
-               len = state->len;
-               off = state->off;
-       }
-
        while ((skb = skb_peek(&psock->ingress_skb))) {
                len = skb->len;
                off = 0;
@@ -670,6 +665,13 @@ static void sk_psock_backlog(struct work_struct *work)
                        off = stm->offset;
                        len = stm->full_len;
                }
+
+               /* Resume processing from previous partial state */
+               if (unlikely(state->len)) {
+                       len = state->len;
+                       off = state->off;
+               }
+
                ingress = skb_bpf_ingress(skb);
                skb_bpf_redirect_clear(skb);
                do {
@@ -698,6 +700,8 @@ static void sk_psock_backlog(struct work_struct *work)
                        len -= ret;
                } while (len);
 
+               /* The entire skb sent, clear state */
+               sk_psock_skb_state(psock, state, 0, 0);
                skb = skb_dequeue(&psock->ingress_skb);
                kfree_skb(skb);
        }