net: Annotate sk->sk_write_space() for UDP SOCKMAP.

UDP TX skb->destructor() is sock_wfree(), and UDP holds lock_sock()
only for UDP_CORK / MSG_MORE sendmsg().

Otherwise, sk->sk_write_space() may be read locklessly while SOCKMAP
rewrites sk->sk_write_space().

Let's use WRITE_ONCE() and READ_ONCE() for sk->sk_write_space().

Note that the write side is annotated by commit 2ef2b20cf4e0
("net: annotate data-races around sk->sk_{data_ready,write_space}").

Fixes: 7b98cd42b049 ("bpf: sockmap: Add UDP support")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://patch.msgid.link/20260529193941.3897256-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/core/sock.c b/net/core/sock.c
index b37b664b6eb92f375d6708a5a609f35f07ee2897..d097025c116a863b29346c12470a9c81ec38ac56 100644 (file)
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2676,8 +2676,12 @@ void sock_wfree(struct sk_buff *skb)
        int old;
 
        if (!sock_flag(sk, SOCK_USE_WRITE_QUEUE)) {
+               void (*sk_write_space)(struct sock *sk);
+
+               sk_write_space = READ_ONCE(sk->sk_write_space);
+
                if (sock_flag(sk, SOCK_RCU_FREE) &&
-                   sk->sk_write_space == sock_def_write_space) {
+                   sk_write_space == sock_def_write_space) {
                        rcu_read_lock();
                        free = __refcount_sub_and_test(len, &sk->sk_wmem_alloc,
                                                       &old);
@@ -2693,7 +2697,7 @@ void sock_wfree(struct sk_buff *skb)
                 * after sk_write_space() call
                 */
                WARN_ON(refcount_sub_and_test(len - 1, &sk->sk_wmem_alloc));
-               sk->sk_write_space(sk);
+               sk_write_space(sk);
                len = 1;
        }
        /*