diff options
| author | Alexei Starovoitov <ast@kernel.org> | 2026-11-01 19:05:23 +0000 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-11-02 00:10:39 +0000 |
| commit | 6d8118937ba477e03fa2e94e9bd9abac7291a2a2 (patch) | |
| tree | 15ce0658578b65b3c27145f9cb0289ca6f66f1bc /scripts/basic/split-include.c | |
| parent | 3f9780d62dd1112ca15b5ae73568d29d42ccc950 (diff) | |
| download | linux-6d8118937ba477e03fa2e94e9bd9abac7291a2a2.tar.gz linux-6d8118937ba477e03fa2e94e9bd9abac7291a2a2.zip | |
bpf: Don't let bpf_skb_adjust_room() raise gso_size to GSO_BY_FRAGS
When bpf_skb_adjust_room() shrinks a TCP GSO skb, it adds the number of
removed bytes to gso_size. gso_size has 16 bits, and nothing checks the
sum. Thus gso_size can wrap to 0 or to a small size, or it can be
GSO_BY_FRAGS. GSO_BY_FRAGS is not a size. It tells skb_segment() to read
the length of each segment from the frag_list. If the TCP GSO skb has no
frag_list, skb_segment() dereferences a NULL pointer.
Return -ENOTSUPP and do not change the skb if the sum is GSO_BY_FRAGS or
larger. With BPF_F_ADJ_ROOM_FIXED_GSO the helper does not change gso_size,
so it shrinks the skb as before.
Fixes: 2be7e212d541 ("bpf: add bpf_skb_adjust_room helper")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261101190535.1454146-16-alexei.starovoitov@gmail.com
Diffstat (limited to 'scripts/basic/split-include.c')
0 files changed, 0 insertions, 0 deletions