[v3] net: linearizing skb when downgrade gso_size

Commit Message

Fred Li July 17, 2024, 5:35 a.m. UTC

Linearizing skb when downgrade gso_size because it may
trigger the BUG_ON when segment skb as described in [1].

v3 changes:
  linearize skb if having frag_list as Willem de Bruijn suggested[2].

[1] https://lore.kernel.org/all/[e-mail]/
[2] https://lore.kernel.org/all/[e-mail]/

Signed-off-by: Fred Li <[e-mail]>
---
 net/core/filter.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

Comments

Willem de Bruijn July 17, 2024, 4:32 p.m. UTC | #1

Fred Li wrote:
> Linearizing skb when downgrade gso_size because it may
> trigger the BUG_ON when segment skb as described in [1].
> 
> v3 changes:
>   linearize skb if having frag_list as Willem de Bruijn suggested[2].
> 
> [1] https://lore.kernel.org/all/[e-mail]/
> [2] https://lore.kernel.org/all/[e-mail]/
> 
> Signed-off-by: Fred Li <[e-mail]>

A fix needs a Fixed tag.

This might be the original commit that introduced gso_size adjustment,
commit 6578171a7ff0c ("bpf: add bpf_skb_change_proto helper")

Unless support for frag_list came later.

> ---
>  net/core/filter.c | 16 ++++++++++++----
>  1 file changed, 12 insertions(+), 4 deletions(-)
> 
> diff --git a/net/core/filter.c b/net/core/filter.c
> index df4578219e82..70919b532d68 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -3525,13 +3525,21 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
>  	if (skb_is_gso(skb)) {
>  		struct skb_shared_info *shinfo = skb_shinfo(skb);
>  
> -		/* Due to header grow, MSS needs to be downgraded. */
> -		if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
> -			skb_decrease_gso_size(shinfo, len_diff);
> -
>  		/* Header must be checked, and gso_segs recomputed. */
>  		shinfo->gso_type |= gso_type;
>  		shinfo->gso_segs = 0;
> +
> +		/* Due to header grow, MSS needs to be downgraded.
> +		 * There is BUG_ON When segment the frag_list with
> +		 * head_frag true so linearize skb after downgrade
> +		 * the MSS.
> +		 */

Super tiny nit: no capitalization of When in the middle of a sentence.

> +		if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) {
> +			skb_decrease_gso_size(shinfo, len_diff);
> +			if (shinfo->frag_list)
> +				return skb_linearize(skb);

I previously asked whether it was safe to call pskb_expand_head from
within a BPF external function. There are actually plenty of existing
examples of this, so this is fine.

> +		}
> +
>  	}
>  
>  	return 0;
> -- 
> 2.33.0
>

Fred Li July 18, 2024, 7:42 a.m. UTC | #2

> 
> > Linearizing skb when downgrade gso_size because it may
> > trigger the BUG_ON when segment skb as described in [1].
> > 
> > v3 changes:
> >   linearize skb if having frag_list as Willem de Bruijn suggested[2].
> > 
> > [1] https://lore.kernel.org/all/[e-mail]/
> > [2] https://lore.kernel.org/all/[e-mail]/
> > 
> > Signed-off-by: Fred Li <[e-mail]>
> 
> A fix needs a Fixed tag.
> 
> This might be the original commit that introduced gso_size adjustment,
> commit 6578171a7ff0c ("bpf: add bpf_skb_change_proto helper")
> 

Yes, this is the original commit, but it's already fixed by commit 
364745fbe981a (bpf: Do not change gso_size during bpf_skb_change_proto())

Another commit 2be7e212d5419 (bpf: add bpf_skb_adjust_room helper) introduced
gso_size too.

> Unless support for frag_list came later.
> 
> > ---
> >  net/core/filter.c | 16 ++++++++++++----
> >  1 file changed, 12 insertions(+), 4 deletions(-)
> > 
> > diff --git a/net/core/filter.c b/net/core/filter.c
> > index df4578219e82..70919b532d68 100644
> > --- a/net/core/filter.c
> > +++ b/net/core/filter.c
> > @@ -3525,13 +3525,21 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
> >  	if (skb_is_gso(skb)) {
> >  		struct skb_shared_info *shinfo = skb_shinfo(skb);
> >  
> > -		/* Due to header grow, MSS needs to be downgraded. */
> > -		if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
> > -			skb_decrease_gso_size(shinfo, len_diff);
> > -
> >  		/* Header must be checked, and gso_segs recomputed. */
> >  		shinfo->gso_type |= gso_type;
> >  		shinfo->gso_segs = 0;
> > +
> > +		/* Due to header grow, MSS needs to be downgraded.
> > +		 * There is BUG_ON When segment the frag_list with
> > +		 * head_frag true so linearize skb after downgrade
> > +		 * the MSS.
> > +		 */
> 
> Super tiny nit: no capitalization of When in the middle of a sentence.

Thanks, i'will fix.

> 
> > +		if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) {
> > +			skb_decrease_gso_size(shinfo, len_diff);
> > +			if (shinfo->frag_list)
> > +				return skb_linearize(skb);
> 
> I previously asked whether it was safe to call pskb_expand_head from
> within a BPF external function. There are actually plenty of existing
> examples of this, so this is fine.
> 
> > +		}
> > +
> >  	}
> >  
> >  	return 0;
> > -- 
> > 2.33.0
> >

Patch

diff --git a/net/core/filter.c b/net/core/filter.c
index df4578219e82..70919b532d68 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3525,13 +3525,21 @@  static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
 	if (skb_is_gso(skb)) {
 		struct skb_shared_info *shinfo = skb_shinfo(skb);
 
-		/* Due to header grow, MSS needs to be downgraded. */
-		if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
-			skb_decrease_gso_size(shinfo, len_diff);
-
 		/* Header must be checked, and gso_segs recomputed. */
 		shinfo->gso_type |= gso_type;
 		shinfo->gso_segs = 0;
+
+		/* Due to header grow, MSS needs to be downgraded.
+		 * There is BUG_ON When segment the frag_list with
+		 * head_frag true so linearize skb after downgrade
+		 * the MSS.
+		 */
+		if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) {
+			skb_decrease_gso_size(shinfo, len_diff);
+			if (shinfo->frag_list)
+				return skb_linearize(skb);
+		}
+
 	}
 
 	return 0;