Commit fb206fc3 authored by Jakub Sitnicki's avatar Jakub Sitnicki Committed by Martin KaFai Lau
Browse files

bpf: Make bpf_skb_change_head helper metadata-safe 



Although bpf_skb_change_head() doesn't move packet data after skb_push(),
skb metadata still needs to be relocated. Use the dedicated helper to
handle it.

Signed-off-by: default avatarJakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-9-5ceb08a9b37b@cloudflare.com
parent 8cfc172c

net/core/filter.c

+3 −1
Original line number Diff line number Diff line
@@ -3875,6 +3875,7 @@ static const struct bpf_func_proto sk_skb_change_tail_proto = { 
static inline int __bpf_skb_change_head(struct sk_buff *skb, u32 head_room,

					u64 flags)

{

	const u8 meta_len = skb_metadata_len(skb);

	u32 max_len = BPF_SKB_MAX_LEN;

	u32 new_len = skb->len + head_room;

	int ret;
@@ -3884,7 +3885,7 @@ static inline int __bpf_skb_change_head(struct sk_buff *skb, u32 head_room, 
		     new_len < skb->len))

		return -EINVAL;



	ret = skb_cow(skb, head_room);

	ret = skb_cow(skb, meta_len + head_room);

	if (likely(!ret)) {

		/* Idea for this helper is that we currently only

		 * allow to expand on mac header. This means that
@@ -3896,6 +3897,7 @@ static inline int __bpf_skb_change_head(struct sk_buff *skb, u32 head_room, 
		 * for redirection into L2 device.

		 */

		__skb_push(skb, head_room);

		skb_postpush_data_move(skb, head_room, 0);

		memset(skb->data, 0, head_room);

		skb_reset_mac_header(skb);

		skb_reset_mac_len(skb);