linux-kernel - Re: [PATCH v4] bpf: Fixed a segment issue when downgrade gso

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAF=yD-++mDGU=mm6LE5G6sVVwst7iq6NRicACzeHwOjEdf2Apw@mail.gmail.com>
Date: Fri, 19 Jul 2024 11:22:42 -0700
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: Fred Li <dracodingfly@...il.com>
Cc: andrii@...nel.org, ast@...nel.org, bpf@...r.kernel.org, 
	daniel@...earbox.net, herbert@...dor.apana.org.au, john.fastabend@...il.com, 
	kpsingh@...nel.org, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, 
	pabeni@...hat.com, song@...nel.org, yonghong.song@...ux.dev
Subject: Re: [PATCH v4] bpf: Fixed a segment issue when downgrade gso_size

On Thu, Jul 18, 2024 at 7:47 PM Fred Li <dracodingfly@...il.com> wrote:
>
> Linearizing skb when downgrade gso_size because it may
> trigger the BUG_ON when segment skb as described in [1].
>
> v4 changes:
>   add fixed tag.
>
> v3 changes:
>   linearize skb if having frag_list as Willem de Bruijn suggested[2].
>
> [1] https://lore.kernel.org/all/20240626065555.35460-2-dracodingfly@gmail.com/
> [2] https://lore.kernel.org/all/668d5cf1ec330_1c18c32947@willemb.c.googlers.com.notmuch/
>
> Fixes: 2be7e212d5419 ("bpf: add bpf_skb_adjust_room helper")
> Signed-off-by: Fred Li <dracodingfly@...il.com>

Reviewed-by: Willem de Bruijn <willemb@...gle.com>

For next time:
- add target: [PATCH bpf]
- use imperative mood in commit messages: "Linearize ..."

https://www.kernel.org/doc/Documentation/bpf/bpf_devel_QA.rst
https://www.kernel.org/doc/Documentation/process/submitting-patches.rst

> ---
>  net/core/filter.c | 16 ++++++++++++----
>  1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/net/core/filter.c b/net/core/filter.c
> index df4578219e82..71396ecfc574 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -3525,13 +3525,21 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
>         if (skb_is_gso(skb)) {
>                 struct skb_shared_info *shinfo = skb_shinfo(skb);
>
> -               /* Due to header grow, MSS needs to be downgraded. */
> -               if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
> -                       skb_decrease_gso_size(shinfo, len_diff);
> -
>                 /* Header must be checked, and gso_segs recomputed. */
>                 shinfo->gso_type |= gso_type;
>                 shinfo->gso_segs = 0;
> +
> +               /* Due to header grow, MSS needs to be downgraded.
> +                * There is BUG_ON when segment the frag_list with
> +                * head_frag true so linearize skb after downgrade
> +                * the MSS.
> +                */
> +               if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) {
> +                       skb_decrease_gso_size(shinfo, len_diff);
> +                       if (shinfo->frag_list)
> +                               return skb_linearize(skb);
> +               }
> +
>         }
>
>         return 0;
> --
> 2.33.0
>