From: Josef Bacik sk_psock_backlog() passes the skbs of psock->ingress_skb to the socket of the psock. When the socket has no room, the function saves the length and offset of the remaining data in psock->work_state. A later run continues at this offset and clears the state when the skb is complete. sk_psock_skb_state() saves and clears the state, but only while SK_PSOCK_TX_ENABLED is set. sk_psock_backlog() does not test this flag for each skb. If the socket closes during the loop, sk_psock_stop() clears the flag. The loop continues, but the state of the completed skb stays. The loop uses this state for all subsequent skbs and sends only part of their data. A closing socket may lose the end of a stream, but not the middle. The state belongs to the skb at the head of ingress_skb. Always clear the state when this skb is complete. A stopped psock still saves no new state. Fixes: 3b4f14b79428 ("bpf, sockmap: fix duplicated data transmission") Signed-off-by: Josef Bacik Signed-off-by: Alexei Starovoitov --- net/core/skmsg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index f03519468ad1..a5d498982848 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -664,7 +664,8 @@ static void sk_psock_skb_state(struct sk_psock *psock, int len, int off) { spin_lock_bh(&psock->ingress_lock); - if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) { + /* No new state once the psock is stopped, but never keep an old one */ + if (!len || sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) { state->len = len; state->off = off; } -- 2.55.0