Subject: Re: [PATCH v1 net] net: Annotate sk->sk_write_space() for UDP SOCKMAP.

From: Jakub Sitnicki <[email-masked]>
Date: Mon, 01 Jun 2026 12:45:05 +0200

On Fri, May 29, 2026 at 07:39 PM GMT, Kuniyuki Iwashima wrote:
> UDP TX skb->destructor() is sock_wfree(), and UDP holds lock_sock()
> only for UDP_CORK / MSG_MORE sendmsg().

Nit: lock_sock() serializes map updates via bpf() syscall. We also have
sockmap iterator programs which can insert UDP sockets into sockmap. On
this path, sock_map_update_elem, we grab only bh_lock_sock, so the race
against UDP_CORK / MSG_MORE sendmsg() path also exists.

> Otherwise, sk->sk_write_space() may be read locklessly while SOCKMAP
> rewrites sk->sk_write_space().
>
> Let's use WRITE_ONCE() and READ_ONCE() for sk->sk_write_space().
>
> Note that the write side is annotated by commit 2ef2b20cf4e0
> ("net: annotate data-races around sk->sk_{data_ready,write_space}").
>
> Fixes: 7b98cd42b049 ("bpf: sockmap: Add UDP support")
> Signed-off-by: Kuniyuki Iwashima <[email-masked]>
> ---

Reviewed-by: Jakub Sitnicki <[email-masked]>