[PATCH bpf] bpf: Reject negative head_room in __bpf_skb_change_head

[PATCH bpf] bpf: Reject negative head_room in __bpf_skb_change_head

[Daniel Borkmann]

Yinhao et al. recently reported:

  Our fuzzing tool was able to create a BPF program which triggered
  the below BUG condition inside pskb_expand_head.

  [   23.016047][T10006] kernel BUG at net/core/skbuff.c:2232!
  [...]
  [   23.017301][T10006] RIP: 0010:pskb_expand_head+0x1519/0x1530
  [...]
  [   23.021249][T10006] Call Trace:
  [   23.021387][T10006]  <TASK>
  [   23.021507][T10006]  ? __pfx_pskb_expand_head+0x10/0x10
  [   23.021725][T10006]  __bpf_skb_change_head+0x22a/0x520
  [   23.021939][T10006]  bpf_skb_change_head+0x34/0x1b0
  [   23.022143][T10006]  ___bpf_prog_run+0xf70/0xb670
  [   23.022342][T10006]  __bpf_prog_run32+0xed/0x140
  [...]

The problem is that in __bpf_skb_change_head() we need to reject a
negative head_room as otherwise this propagates all the way to the
pskb_expand_head() from skb_cow(). For example, if the BPF test infra
passes a skb with gso_skb:1 to the BPF helper with a negative head_room
of -22, then this gets passed into skb_cow(). __skb_cow() in this
example calculates a delta of -86 which gets aligned to -64, and then
triggers BUG_ON(nhead < 0). Thus, reject malformed negative input.

Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure")
Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
 net/core/filter.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/filter.c b/net/core/filter.c
index 76628df1fc82..fa06c5a08e22 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3877,7 +3877,8 @@ static inline int __bpf_skb_change_head(struct sk_buff *skb, u32 head_room,
 	u32 new_len = skb->len + head_room;
 	int ret;
 
-	if (unlikely(flags || (!skb_is_gso(skb) && new_len > max_len) ||
+	if (unlikely(flags || (int)head_room < 0 ||
+		     (!skb_is_gso(skb) && new_len > max_len) ||
 		     new_len < skb->len))
 		return -EINVAL;
 
-- 
2.43.0

Re: [PATCH bpf] bpf: Reject negative head_room in __bpf_skb_change_head

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Martin KaFai Lau <martin.lau@kernel.org>:

On Thu, 23 Oct 2025 14:55:32 +0200 you wrote:
> Yinhao et al. recently reported:
> 
>   Our fuzzing tool was able to create a BPF program which triggered
>   the below BUG condition inside pskb_expand_head.
> 
>   [   23.016047][T10006] kernel BUG at net/core/skbuff.c:2232!
>   [...]
>   [   23.017301][T10006] RIP: 0010:pskb_expand_head+0x1519/0x1530
>   [...]
>   [   23.021249][T10006] Call Trace:
>   [   23.021387][T10006]  <TASK>
>   [   23.021507][T10006]  ? __pfx_pskb_expand_head+0x10/0x10
>   [   23.021725][T10006]  __bpf_skb_change_head+0x22a/0x520
>   [   23.021939][T10006]  bpf_skb_change_head+0x34/0x1b0
>   [   23.022143][T10006]  ___bpf_prog_run+0xf70/0xb670
>   [   23.022342][T10006]  __bpf_prog_run32+0xed/0x140
>   [...]
> 
> [...]

Here is the summary with links:
  - [bpf] bpf: Reject negative head_room in __bpf_skb_change_head
    https://git.kernel.org/bpf/bpf/c/2cbb259ec4f8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html