[PATCH RFC net-next 5/9] net-timestamp: use pskb_copy to avoid polluting the orig skb's start time

[Jason Xing <kerneljasonxing@gmail.com>]

When BPF Timestamping V2 is active, start_time is stored in the
skb_shared_hwtstamps union alongside hwtstamp. In __skb_tstamp_tx(), the
!tsonly path uses skb_clone() to create the error-queue skb, which shares
skb_shared_info with the original.

If net timestamping feature and BPF timestamping v2 are both enabled,
When the driver reports a hardware TX timestamp, the subsequent write

    *skb_hwtstamps(skb) = *hwtstamps;

clobbers start_time on the retransmit-queue original through the shared
memory, corrupting the value seen by later BPF hooks and retransmissions.

Apply pskb_copy() instead of skb_clone() in this case. Then pskb_copy()
gives the error-queue skb its own skb_shared_info while still sharing
page frags.

Signed-off-by: Jason Xing <kerneljasonxing@gmail.com>
---
 net/core/skbuff.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 966af3beed94..44aeea713da7 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5749,7 +5749,10 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
 #endif
 			skb = alloc_skb(0, GFP_ATOMIC);
 	} else {
-		skb = skb_clone(orig_skb, GFP_ATOMIC);
+		if (static_branch_unlikely(&bpfts_v2_needed_key) && hwtstamps)
+			skb = pskb_copy(orig_skb, GFP_ATOMIC);
+		else
+			skb = skb_clone(orig_skb, GFP_ATOMIC);
 
 		if (skb_orphan_frags_rx(skb, GFP_ATOMIC)) {
 			kfree_skb(skb);
-- 
2.43.7