bpf: sockmap, updating the sg structure should also update curr

Curr pointer should be updated when the sg structure is shifted.

Fixes: 7246d8ed4dcce ("bpf: helper to pop data from messages")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/20231206232706.374377-3-john.fastabend@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/core/filter.c b/net/core/filter.c
index 7e4d7c3bcc849a9211eca4246cda7fa76af13c36..1737884be52f85ac5818b870ae567ebc3501bfb6 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2602,6 +2602,22 @@ BPF_CALL_2(bpf_msg_cork_bytes, struct sk_msg *, msg, u32, bytes)
        return 0;
 }
 
+static void sk_msg_reset_curr(struct sk_msg *msg)
+{
+       u32 i = msg->sg.start;
+       u32 len = 0;
+
+       do {
+               len += sk_msg_elem(msg, i)->length;
+               sk_msg_iter_var_next(i);
+               if (len >= msg->sg.size)
+                       break;
+       } while (i != msg->sg.end);
+
+       msg->sg.curr = i;
+       msg->sg.copybreak = 0;
+}
+
 static const struct bpf_func_proto bpf_msg_cork_bytes_proto = {
        .func           = bpf_msg_cork_bytes,
        .gpl_only       = false,
@@ -2721,6 +2737,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_msg *, msg, u32, start,
                      msg->sg.end - shift + NR_MSG_FRAG_IDS :
                      msg->sg.end - shift;
 out:
+       sk_msg_reset_curr(msg);
        msg->data = sg_virt(&msg->sg.data[first_sge]) + start - offset;
        msg->data_end = msg->data + bytes;
        return 0;
@@ -2857,6 +2874,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
                msg->sg.data[new] = rsge;
        }
 
+       sk_msg_reset_curr(msg);
        sk_msg_compute_data_pointers(msg);
        return 0;
 }
@@ -3025,6 +3043,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,
 
        sk_mem_uncharge(msg->sk, len - pop);
        msg->sg.size -= (len - pop);
+       sk_msg_reset_curr(msg);
        sk_msg_compute_data_pointers(msg);
        return 0;
 }