diff options
| author | Fred Li <dracodingfly@gmail.com> | 2024-07-19 10:46:53 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-08-03 09:01:03 +0200 |
| commit | ec4eea14d75f7b0491194dd413f540dd19b8c733 (patch) | |
| tree | 57a30e778ae4adaa1589faac88b2fa8d7bf96cc9 | |
| parent | af6bd5c9901b13a26eaf4d57d97a813297791596 (diff) | |
| download | linux-ec4eea14d75f7b0491194dd413f540dd19b8c733.tar.gz linux-ec4eea14d75f7b0491194dd413f540dd19b8c733.tar.bz2 linux-ec4eea14d75f7b0491194dd413f540dd19b8c733.zip | |
bpf: Fix a segment issue when downgrading gso_size
[ Upstream commit fa5ef655615a01533035c6139248c5b33aa27028 ]
Linearize the skb when downgrading gso_size because it may trigger a
BUG_ON() later when the skb is segmented as described in [1,2].
Fixes: 2be7e212d5419 ("bpf: add bpf_skb_adjust_room helper")
Signed-off-by: Fred Li <dracodingfly@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/all/20240626065555.35460-2-dracodingfly@gmail.com [1]
Link: https://lore.kernel.org/all/668d5cf1ec330_1c18c32947@willemb.c.googlers.com.notmuch [2]
Link: https://lore.kernel.org/bpf/20240719024653.77006-1-dracodingfly@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/core/filter.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/net/core/filter.c b/net/core/filter.c index 9933851c685e..110692c1dd95 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -3544,13 +3544,20 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff, if (skb_is_gso(skb)) { struct skb_shared_info *shinfo = skb_shinfo(skb); - /* Due to header grow, MSS needs to be downgraded. */ - if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) - skb_decrease_gso_size(shinfo, len_diff); - /* Header must be checked, and gso_segs recomputed. */ shinfo->gso_type |= gso_type; shinfo->gso_segs = 0; + + /* Due to header growth, MSS needs to be downgraded. + * There is a BUG_ON() when segmenting the frag_list with + * head_frag true, so linearize the skb after downgrading + * the MSS. + */ + if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) { + skb_decrease_gso_size(shinfo, len_diff); + if (shinfo->frag_list) + return skb_linearize(skb); + } } return 0; |