Commit d946f3c9 authored by Martin KaFai Lau's avatar Martin KaFai Lau Committed by Alexei Starovoitov
Browse files

bpf: Check skb->transport_header is set in bpf_skb_check_mtu



The bpf_skb_check_mtu helper needs to use skb->transport_header when
the BPF_MTU_CHK_SEGS flag is used:

	bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS)

The transport_header is not always set. There is a WARN_ON_ONCE
report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set +
bpf_prog_test_run is used:

WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071
 skb_gso_validate_network_len
 bpf_skb_check_mtu
 bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch
 bpf_test_run
 bpf_prog_test_run_skb

For a normal ingress skb (not test_run), skb_reset_transport_header
is performed but there is plan to avoid setting it as described in
commit 2170a1f0 ("net: no longer reset transport_header in __netif_receive_skb_core()").

This patch fixes the bpf helper by checking
skb_transport_header_was_set(). The check is done just before
skb->transport_header is used, to avoid breaking the existing bpf prog.
The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.

Fixes: 34b2021c ("bpf: Add BPF-helper for MTU checking")
Cc: Jesper Dangaard Brouer <hawk@kernel.org>
Reported-by: default avatarKaiyan Mei <M202472210@hust.edu.cn>
Reported-by: default avatarYinhao Hu <dddddd@hust.edu.cn>
Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/r/20251112232331.1566074-1-martin.lau@linux.dev


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 4f7bc83b
Loading
Loading
Loading
Loading
+6 −3
Original line number Diff line number Diff line
@@ -6429,10 +6429,13 @@ BPF_CALL_5(bpf_skb_check_mtu, struct sk_buff *, skb,
	 */
	if (skb_is_gso(skb)) {
		ret = BPF_MTU_CHK_RET_SUCCESS;
		if (flags & BPF_MTU_CHK_SEGS &&
		    !skb_gso_validate_network_len(skb, mtu))
		if (flags & BPF_MTU_CHK_SEGS) {
			if (!skb_transport_header_was_set(skb))
				return -EINVAL;
			if (!skb_gso_validate_network_len(skb, mtu))
				ret = BPF_MTU_CHK_RET_SEGS_TOOBIG;
		}
	}
out:
	*mtu_len = mtu;
	return ret;