From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Jesper Dangaard Brouer <brouer@redhat.com>,
Daniel Borkmann <daniel@iogearbox.net>,
John Fastabend <john.fastabend@gmail.com>
Subject: [PATCH 4.9 18/35] bpf: Remove MTU check in __bpf_skb_max_len
Date: Mon, 5 Apr 2021 10:53:53 +0200 [thread overview]
Message-ID: <20210405085019.455875111@linuxfoundation.org> (raw)
In-Reply-To: <20210405085018.871387942@linuxfoundation.org>
From: Jesper Dangaard Brouer <brouer@redhat.com>
commit 6306c1189e77a513bf02720450bb43bd4ba5d8ae upstream.
Multiple BPF-helpers that can manipulate/increase the size of the SKB uses
__bpf_skb_max_len() as the max-length. This function limit size against
the current net_device MTU (skb->dev->mtu).
When a BPF-prog grow the packet size, then it should not be limited to the
MTU. The MTU is a transmit limitation, and software receiving this packet
should be allowed to increase the size. Further more, current MTU check in
__bpf_skb_max_len uses the MTU from ingress/current net_device, which in
case of redirects uses the wrong net_device.
This patch keeps a sanity max limit of SKB_MAX_ALLOC (16KiB). The real limit
is elsewhere in the system. Jesper's testing[1] showed it was not possible
to exceed 8KiB when expanding the SKB size via BPF-helper. The limiting
factor is the define KMALLOC_MAX_CACHE_SIZE which is 8192 for
SLUB-allocator (CONFIG_SLUB) in-case PAGE_SIZE is 4096. This define is
in-effect due to this being called from softirq context see code
__gfp_pfmemalloc_flags() and __do_kmalloc_node(). Jakub's testing showed
that frames above 16KiB can cause NICs to reset (but not crash). Keep this
sanity limit at this level as memory layer can differ based on kernel
config.
[1] https://github.com/xdp-project/bpf-examples/tree/master/MTU-tests
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/161287788936.790810.2937823995775097177.stgit@firesoul
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/filter.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2120,10 +2120,7 @@ static u32 __bpf_skb_min_len(const struc
return min_len;
}
-static u32 __bpf_skb_max_len(const struct sk_buff *skb)
-{
- return skb->dev->mtu + skb->dev->hard_header_len;
-}
+#define BPF_SKB_MAX_LEN SKB_MAX_ALLOC
static int bpf_skb_grow_rcsum(struct sk_buff *skb, unsigned int new_len)
{
@@ -2144,7 +2141,7 @@ static int bpf_skb_trim_rcsum(struct sk_
BPF_CALL_3(bpf_skb_change_tail, struct sk_buff *, skb, u32, new_len,
u64, flags)
{
- u32 max_len = __bpf_skb_max_len(skb);
+ u32 max_len = BPF_SKB_MAX_LEN;
u32 min_len = __bpf_skb_min_len(skb);
int ret;
next prev parent reply other threads:[~2021-04-05 8:57 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-05 8:53 [PATCH 4.9 00/35] 4.9.265-rc1 review Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 01/35] selinux: vsock: Set SID for socket returned by accept() Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 02/35] ipv6: weaken the v4mapped source check Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 03/35] ext4: fix bh ref count on error paths Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 04/35] rpc: fix NULL dereference on kmalloc failure Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 05/35] ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10 Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 06/35] ASoC: rt5651: " Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 07/35] ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value on probe Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 08/35] powerpc: Force inlining of cpu_has_feature() to avoid build failure Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 09/35] vhost: Fix vhost_vq_reset() Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 10/35] scsi: st: Fix a use after free in st_open() Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 11/35] scsi: qla2xxx: Fix broken #endif placement Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 12/35] staging: comedi: cb_pcidas: fix request_irq() warn Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 13/35] staging: comedi: cb_pcidas64: " Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 14/35] ASoC: rt5659: Update MCLK rate in set_sysclk() Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 15/35] ext4: do not iput inode under running transaction in ext4_rename() Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 16/35] appletalk: Fix skb allocation size in loopback case Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 17/35] net: wan/lmc: unregister device when no matching device is found Greg Kroah-Hartman
2021-04-05 8:53 ` Greg Kroah-Hartman [this message]
2021-04-05 8:53 ` [PATCH 4.9 19/35] ALSA: usb-audio: Apply sample rate quirk to Logitech Connect Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 20/35] ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 21/35] tracing: Fix stack trace event size Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 22/35] mm: fix race by making init_zero_pfn() early_initcall Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 23/35] reiserfs: update reiserfs_xattrs_initialized() condition Greg Kroah-Hartman
2021-04-05 8:53 ` [PATCH 4.9 24/35] pinctrl: rockchip: fix restore error in resume Greg Kroah-Hartman
2021-04-05 8:54 ` [PATCH 4.9 25/35] extcon: Fix error handling in extcon_dev_register Greg Kroah-Hartman
2021-04-05 8:54 ` [PATCH 4.9 26/35] firewire: nosy: Fix a use-after-free bug in nosy_ioctl() Greg Kroah-Hartman
2021-04-05 8:54 ` [PATCH 4.9 27/35] USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem Greg Kroah-Hartman
2021-04-05 8:54 ` [PATCH 4.9 28/35] usb: xhci-mtk: fix broken streams issue on 0.96 xHCI Greg Kroah-Hartman
2021-04-05 8:54 ` [PATCH 4.9 29/35] cdc-acm: fix BREAK rx code path adding necessary calls Greg Kroah-Hartman
2021-04-05 8:54 ` [PATCH 4.9 30/35] USB: cdc-acm: downgrade message to debug Greg Kroah-Hartman
2021-04-05 8:54 ` [PATCH 4.9 31/35] USB: cdc-acm: fix use-after-free after probe failure Greg Kroah-Hartman
2021-04-05 8:54 ` [PATCH 4.9 32/35] staging: rtl8192e: Fix incorrect source in memcpy() Greg Kroah-Hartman
2021-04-05 8:54 ` [PATCH 4.9 33/35] staging: rtl8192e: Change state information from u16 to u8 Greg Kroah-Hartman
2021-04-05 8:54 ` [PATCH 4.9 34/35] audit: fix a net reference leak in audit_send_reply() Greg Kroah-Hartman
2021-04-05 8:54 ` [PATCH 4.9 35/35] audit: fix a net reference leak in audit_list_rules_send() Greg Kroah-Hartman
2021-04-05 17:27 ` [PATCH 4.9 00/35] 4.9.265-rc1 review Florian Fainelli
2021-04-05 17:56 ` Guenter Roeck
2021-04-05 23:51 ` Guenter Roeck
2021-04-06 2:22 ` Guenter Roeck
2021-04-06 2:36 ` Guenter Roeck
2021-04-07 10:18 ` Greg Kroah-Hartman
2021-04-06 0:29 ` Shuah Khan
2021-04-06 7:40 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210405085019.455875111@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=brouer@redhat.com \
--cc=daniel@iogearbox.net \
--cc=john.fastabend@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).