bpf: Fix a segment issue when downgrading gso_size

Linearize the skb when downgrading gso_size because it may trigger a
BUG_ON() later when the skb is segmented as described in [1,2].

Fixes: 2be7e212d5419 ("bpf: add bpf_skb_adjust_room helper")
Signed-off-by: Fred Li <dracodingfly@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/all/20240626065555.35460-2-dracodingfly@gmail.com
Link: https://lore.kernel.org/all/668d5cf1ec330_1c18c32947@willemb.c.googlers.com.notmuch
Link: https://lore.kernel.org/bpf/20240719024653.77006-1-dracodingfly@gmail.com

diff --git a/net/core/filter.c b/net/core/filter.c
index 4cf1d34f761728cff1e917a59a586b6afb178a82..f3c72cf86099745ee8eb56f56711db92e6bfc84e 100644 (file)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3548,13 +3548,20 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
        if (skb_is_gso(skb)) {
                struct skb_shared_info *shinfo = skb_shinfo(skb);
 
-               /* Due to header grow, MSS needs to be downgraded. */
-               if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
-                       skb_decrease_gso_size(shinfo, len_diff);
-
                /* Header must be checked, and gso_segs recomputed. */
                shinfo->gso_type |= gso_type;
                shinfo->gso_segs = 0;
+
+               /* Due to header growth, MSS needs to be downgraded.
+                * There is a BUG_ON() when segmenting the frag_list with
+                * head_frag true, so linearize the skb after downgrading
+                * the MSS.
+                */
+               if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) {
+                       skb_decrease_gso_size(shinfo, len_diff);
+                       if (shinfo->frag_list)
+                               return skb_linearize(skb);
+               }
        }
 
        return 0;