Re: [PATCH net 1/2] net: fix skb length accounting after generic XDP frag adjustment

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] A generic XDP program can trigger a kernel panic via BUG_ON() in __skb_pull() by dropping all fragments and then manipulating head and tail lengths.
--

--- Patch [1]: [PATCH net 1/2] net: fix skb length accounting after generic XDP frag adjustment ---
commit 553adb7b7f41a20f63d7c32e81ef98469247c00c
Author: Sun Jian <sun.jian.kdev@gmail.com>

net: fix skb length accounting after generic XDP frag adjustment

This commit fixes skb length accounting after generic XDP fragment
adjustments by keeping skb->len and skb->data_len synchronized. It
subtracts the old data_len before replacing it and adds the new
data_len afterwards.

Link: https://lore.kernel.org/r/20260720141859.19FF41F000E9@smtp.kernel.org
Link: https://lore.kernel.org/bpf/al9T9Eto%2FhRIzP5W@boxer/

> diff --git a/net/core/dev.c b/net/core/dev.c
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
[ ... ]
> @@ -5497,12 +5517,14 @@ u32 bpf_prog_run_generic_xdp(struct sk_buff *skb, struct xdp_buff *xdp,
>  
>  	/* check if bpf_xdp_adjust_head was used */
>  	off = xdp->data - orig_data;
>  	if (off) {
>  		if (off > 0)
>  			__skb_pull(skb, off);

[Severity: High]
This is a pre-existing issue, but can this sequence trigger a kernel panic
via BUG_ON() in __skb_pull()?

If an XDP program drops all fragments via bpf_xdp_adjust_tail() with a
negative offset, grows the linear tailroom, and shrinks the linear head by
consuming the newly added space, it seems __skb_pull() is called while
skb->data_len still holds the original large fragment size.

Since the fragment adjustments to skb->data_len are synchronized further down
in this function, could skb->len drop below skb->data_len during this pull
and trigger the BUG() inside __skb_pull()?

>  		else if (off < 0)
>  			__skb_push(skb, -off);
>  
>  		skb->mac_header += off;
>  		skb_reset_network_header(skb);
>  	}
[ ... ]
>  	/* XDP frag metadata (e.g. nr_frags) are updated in eBPF helpers
> -	 * (e.g. bpf_xdp_adjust_tail), we need to update data_len here.
> +	 * (e.g. bpf_xdp_adjust_tail), update skb length fields here.
>  	 */
> +	skb->len -= skb->data_len;
>  	if (xdp_buff_has_frags(xdp))
>  		skb->data_len = skb_shinfo(skb)->xdp_frags_size;
>  	else
>  		skb->data_len = 0;
> +	skb->len += skb->data_len;
>  
>  	/* check if XDP changed eth hdr such SKB needs update */
>  	eth = (struct ethhdr *)xdp->data;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727032535.13469-1-sun.jian.kdev@gmail.com?part=1