From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-00082601.pphosted.com ([67.231.153.30]:48844 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751310AbeCTFQW (ORCPT ); Tue, 20 Mar 2018 01:16:22 -0400 Received: from pps.filterd (m0001255.ppops.net [127.0.0.1]) by mx0b-00082601.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w2K5CZfW029073 for ; Mon, 19 Mar 2018 22:16:22 -0700 Received: from mail.thefacebook.com ([199.201.64.23]) by mx0b-00082601.pphosted.com with ESMTP id 2gtpe70q93-4 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Mon, 19 Mar 2018 22:16:22 -0700 From: Yonghong Song To: , , , , CC: Subject: [PATCH net-next 0/2] net: permit skb_segment on head_frag frag_list skb Date: Mon, 19 Mar 2018 22:16:16 -0700 Message-ID: <20180320051618.2691692-1-yhs@fb.com> MIME-Version: 1.0 Content-Type: text/plain Sender: netdev-owner@vger.kernel.org List-ID: One of our in-house projects, bpf-based NAT, hits a kernel BUG_ON at function skb_segment(), line 3667. The bpf program attaches to clsact ingress, calls bpf_skb_change_proto to change protocol from ipv4 to ipv6 or from ipv6 to ipv4, and then calls bpf_redirect to send the changed packet out. ... 3665 while (pos < offset + len) { 3666 if (i >= nfrags) { 3667 BUG_ON(skb_headlen(list_skb)); ... The triggering input skb has the following properties: list_skb = skb->frag_list; skb->nfrags != NULL && skb_headlen(list_skb) != 0 and skb_segment() is not able to handle a frag_list skb if its headlen (list_skb->len - list_skb->data_len) is not 0. Patch #1 provides a simple solution to avoid BUG_ON. If list_skb->head_frag is true, its page-backed frag will be processed before the list_skb->frags. Patch #2 provides a test case in test_bpf module which constructs a skb and calls skb_segment() directly. The test case is able to trigger the BUG_ON without Patch #1. Yonghong Song (2): net: permit skb_segment on head_frag frag_list skb net: bpf: add a test for skb_segment in test_bpf module lib/test_bpf.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++++++- net/core/skbuff.c | 42 ++++++++++++++++++++++---------- 2 files changed, 100 insertions(+), 13 deletions(-) -- 2.9.5