[net-next PATCH] bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn't

[net-next PATCH] bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn't

[Jesper Dangaard Brouer]

The frame_size passed to build_skb must be aligned, else it is
possible that the embedded struct skb_shared_info gets unaligned.

For correctness make sure that xdpf->headroom in included in the
alignment. No upstream drivers can hit this, as all XDP drivers provide
an aligned headroom.  This was discovered when playing with implementing
XDP support for mvneta, which have a 2 bytes DSA header, and this
Marvell ARM64 platform didn't like doing atomic operations on an
unaligned skb_shinfo(skb)->dataref addresses.

Fixes: 1c601d829ab0 ("bpf: cpumap xdp_buff to skb conversion and allocation")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
---
 kernel/bpf/cpumap.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
index 24aac0d0f412..8974b3755670 100644
--- a/kernel/bpf/cpumap.c
+++ b/kernel/bpf/cpumap.c
@@ -183,7 +183,7 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
 	 * is not at a fixed memory location, with mixed length
 	 * packets, which is bad for cache-line hotness.
 	 */
-	frame_size = SKB_DATA_ALIGN(xdpf->len) + xdpf->headroom +
+	frame_size = SKB_DATA_ALIGN(xdpf->len + xdpf->headroom) +
 		SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
 
 	pkt_data_start = xdpf->data - xdpf->headroom;

Re: [net-next PATCH] bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn't

[Daniel Borkmann]

On 12/19/2018 05:00 PM, Jesper Dangaard Brouer wrote:
> The frame_size passed to build_skb must be aligned, else it is
> possible that the embedded struct skb_shared_info gets unaligned.
> 
> For correctness make sure that xdpf->headroom in included in the
> alignment. No upstream drivers can hit this, as all XDP drivers provide
> an aligned headroom.  This was discovered when playing with implementing
> XDP support for mvneta, which have a 2 bytes DSA header, and this
> Marvell ARM64 platform didn't like doing atomic operations on an
> unaligned skb_shinfo(skb)->dataref addresses.
> 
> Fixes: 1c601d829ab0 ("bpf: cpumap xdp_buff to skb conversion and allocation")
> Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>

Applied to bpf-next, thanks!