Commit ae1d8254 authored Aug 22, 2024 by Fred Li Committed by Zhengchao Shao Aug 22, 2024

bpf: Fix a segment issue when downgrading gso_size

stable inclusion
from stable-v5.10.224
commit dda518dea60d556a2d171c0122ca7d9fdb7d473a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPRL
CVE: CVE-2024-42281

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=dda518dea60d556a2d171c0122ca7d9fdb7d473a



---------------------------

[ Upstream commit fa5ef655615a01533035c6139248c5b33aa27028 ]

Linearize the skb when downgrading gso_size because it may trigger a
BUG_ON() later when the skb is segmented as described in [1,2].

Fixes: 2be7e212 ("bpf: add bpf_skb_adjust_room helper")
Signed-off-by: Fred Li <dracodingfly@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/all/20240626065555.35460-2-dracodingfly@gmail.com [1]
Link: https://lore.kernel.org/all/668d5cf1ec330_1c18c32947@willemb.c.googlers.com.notmuch [2]
Link: https://lore.kernel.org/bpf/20240719024653.77006-1-dracodingfly@gmail.com


Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>

parent 2a231005

net/core/filter.c

+11 −4

Original line number	Diff line number	Diff line
		@@ -3532,13 +3532,20 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
		if (skb_is_gso(skb)) {
		struct skb_shared_info *shinfo = skb_shinfo(skb);

		/* Due to header grow, MSS needs to be downgraded. */
		if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO))
		skb_decrease_gso_size(shinfo, len_diff);

		/* Header must be checked, and gso_segs recomputed. */
		shinfo->gso_type \|= gso_type;
		shinfo->gso_segs = 0;

		/* Due to header growth, MSS needs to be downgraded.
		* There is a BUG_ON() when segmenting the frag_list with
		* head_frag true, so linearize the skb after downgrading
		* the MSS.
		*/
		if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) {
		skb_decrease_gso_size(shinfo, len_diff);
		if (shinfo->frag_list)
		return skb_linearize(skb);
		}
		}

		return 0;