diff options
| author | Dongseok Yi <dseok.yi@samsung.com> | 2021-05-12 16:27:33 +0900 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2021-05-18 22:05:36 +0200 |
| commit | fa7b83bf3b156c767f3e4a25bbf3817b08f3ff8e (patch) | |
| tree | 7519c58ba4dbaf42da1cc19e069d405011bb72e7 /net/bpf | |
| parent | c49661aa6f7097047b7e86ad37b1cf308a7a8d4f (diff) | |
bpf: Check for BPF_F_ADJ_ROOM_FIXED_GSO when bpf_skb_change_proto
In the forwarding path GRO -> BPF 6 to 4 -> GSO for TCP traffic, the
coalesced packet payload can be > MSS, but < MSS + 20.
bpf_skb_proto_6_to_4() will upgrade the MSS and it can be > the payload
length. After then tcp_gso_segment checks for the payload length if it
is <= MSS. The condition is causing the packet to be dropped.
tcp_gso_segment():
[...]
mss = skb_shinfo(skb)->gso_size;
if (unlikely(skb->len <= mss))
goto out;
[...]
Allow to upgrade/downgrade MSS only when BPF_F_ADJ_ROOM_FIXED_GSO is
not set.
Signed-off-by: Dongseok Yi <dseok.yi@samsung.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/bpf/1620804453-57566-1-git-send-email-dseok.yi@samsung.com
Diffstat (limited to 'net/bpf')
0 files changed, 0 insertions, 0 deletions