bpf: Check for BPF_F_ADJ_ROOM_FIXED_GSO when bpf_skb_change_proto
authorDongseok Yi <dseok.yi@samsung.com>
Wed, 12 May 2021 07:27:33 +0000 (16:27 +0900)
committerDaniel Borkmann <daniel@iogearbox.net>
Tue, 18 May 2021 20:05:36 +0000 (22:05 +0200)
commitfa7b83bf3b156c767f3e4a25bbf3817b08f3ff8e
tree7519c58ba4dbaf42da1cc19e069d405011bb72e7
parentc49661aa6f7097047b7e86ad37b1cf308a7a8d4f
bpf: Check for BPF_F_ADJ_ROOM_FIXED_GSO when bpf_skb_change_proto

In the forwarding path GRO -> BPF 6 to 4 -> GSO for TCP traffic, the
coalesced packet payload can be > MSS, but < MSS + 20.

bpf_skb_proto_6_to_4() will upgrade the MSS and it can be > the payload
length. After then tcp_gso_segment checks for the payload length if it
is <= MSS. The condition is causing the packet to be dropped.

tcp_gso_segment():
        [...]
        mss = skb_shinfo(skb)->gso_size;
        if (unlikely(skb->len <= mss))
                goto out;
        [...]

Allow to upgrade/downgrade MSS only when BPF_F_ADJ_ROOM_FIXED_GSO is
not set.

Signed-off-by: Dongseok Yi <dseok.yi@samsung.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/bpf/1620804453-57566-1-git-send-email-dseok.yi@samsung.com
net/core/filter.c