Commit fa5ef655 authored by Fred Li's avatar Fred Li Committed by Daniel Borkmann
Browse files

bpf: Fix a segment issue when downgrading gso_size 



Linearize the skb when downgrading gso_size because it may trigger a
BUG_ON() later when the skb is segmented as described in [1,2].

Fixes: 2be7e212 ("bpf: add bpf_skb_adjust_room helper")
Signed-off-by: default avatarFred Li <dracodingfly@gmail.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Reviewed-by: default avatarWillem de Bruijn <willemb@google.com>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/all/20240626065555.35460-2-dracodingfly@gmail.com [1]
Link: https://lore.kernel.org/all/668d5cf1ec330_1c18c32947@willemb.c.googlers.com.notmuch [2]
Link: https://lore.kernel.org/bpf/20240719024653.77006-1-dracodingfly@gmail.com
parent 13c9b702

net/core/filter.c

+11 −4
Original line number Diff line number Diff line
@@ -3548,13 +3548,20 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff, 
	if (skb_is_gso(skb)) {

		struct skb_shared_info *shinfo = skb_shinfo(skb);



		/* Due to header grow, MSS needs to be downgraded. */

		if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO))

			skb_decrease_gso_size(shinfo, len_diff);



		/* Header must be checked, and gso_segs recomputed. */

		shinfo->gso_type |= gso_type;

		shinfo->gso_segs = 0;



		/* Due to header growth, MSS needs to be downgraded.

		 * There is a BUG_ON() when segmenting the frag_list with

		 * head_frag true, so linearize the skb after downgrading

		 * the MSS.

		 */

		if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) {

			skb_decrease_gso_size(shinfo, len_diff);

			if (shinfo->frag_list)

				return skb_linearize(skb);

		}

	}



	return 0;