Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 31f7a521 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Greg Kroah-Hartman
Browse files

bpf: pull before calling skb_postpull_rcsum() 



[ Upstream commit 54c3f1a81421f85e60ae2eaae7be3727a09916ee ]

Anand hit a BUG() when pulling off headers on egress to a SW tunnel.
We get to skb_checksum_help() with an invalid checksum offset
(commit d7ea0d9df2a6 ("net: remove two BUG() from skb_checksum_help()")
converted those BUGs to WARN_ONs()).
He points out oddness in how skb_postpull_rcsum() gets used.
Indeed looks like we should pull before "postpull", otherwise
the CHECKSUM_PARTIAL fixup from skb_postpull_rcsum() will not
be able to do its job:

	if (skb->ip_summed == CHECKSUM_PARTIAL &&
	    skb_checksum_start_offset(skb) < 0)
		skb->ip_summed = CHECKSUM_NONE;

Reported-by: default avatarAnand Parthasarathy <anpartha@meta.com>
Fixes: 6578171a ("bpf: add bpf_skb_change_proto helper")
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Acked-by: default avatarStanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/r/20221220004701.402165-1-kuba@kernel.org


Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 4916a523

net/core/filter.c

+5 −2
Original line number Diff line number Diff line
@@ -2565,15 +2565,18 @@ static int bpf_skb_generic_push(struct sk_buff *skb, u32 off, u32 len) 


static int bpf_skb_generic_pop(struct sk_buff *skb, u32 off, u32 len)

{

	void *old_data;



	/* skb_ensure_writable() is not needed here, as we're

	 * already working on an uncloned skb.

	 */

	if (unlikely(!pskb_may_pull(skb, off + len)))

		return -ENOMEM;



	skb_postpull_rcsum(skb, skb->data + off, len);

	memmove(skb->data + len, skb->data, off);

	old_data = skb->data;

	__skb_pull(skb, len);

	skb_postpull_rcsum(skb, old_data + off, len);

	memmove(skb->data, old_data, off);



	return 0;

}