From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-00082601.pphosted.com ([67.231.153.30]:56054 "EHLO mx0b-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751302AbeCTPzF (ORCPT ); Tue, 20 Mar 2018 11:55:05 -0400 Received: from pps.filterd (m0109332.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w2KFsQEP007038 for ; Tue, 20 Mar 2018 08:55:04 -0700 Received: from mail.thefacebook.com ([199.201.64.23]) by mx0a-00082601.pphosted.com with ESMTP id 2gu2sa0hww-2 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Tue, 20 Mar 2018 08:55:04 -0700 From: Yonghong Song To: , , , , CC: Subject: [PATCH net-next v2 0/2] net: permit skb_segment on head_frag frag_list skb Date: Tue, 20 Mar 2018 08:54:59 -0700 Message-ID: <20180320155501.1370612-1-yhs@fb.com> MIME-Version: 1.0 Content-Type: text/plain Sender: netdev-owner@vger.kernel.org List-ID: One of our in-house projects, bpf-based NAT, hits a kernel BUG_ON at function skb_segment(), line 3667. The bpf program attaches to clsact ingress, calls bpf_skb_change_proto to change protocol from ipv4 to ipv6 or from ipv6 to ipv4, and then calls bpf_redirect to send the changed packet out. ... 3665 while (pos < offset + len) { 3666 if (i >= nfrags) { 3667 BUG_ON(skb_headlen(list_skb)); ... The triggering input skb has the following properties: list_skb = skb->frag_list; skb->nfrags != NULL && skb_headlen(list_skb) != 0 and skb_segment() is not able to handle a frag_list skb if its headlen (list_skb->len - list_skb->data_len) is not 0. Patch #1 provides a simple solution to avoid BUG_ON. If list_skb->head_frag is true, its page-backed frag will be processed before the list_skb->frags. Patch #2 provides a test case in test_bpf module which constructs a skb and calls skb_segment() directly. The test case is able to trigger the BUG_ON without Patch #1. Changelog: v1 -> v2: . Removed never-hit BUG_ON, spotted by Linyu Yuan. Yonghong Song (2): net: permit skb_segment on head_frag frag_list skb net: bpf: add a test for skb_segment in test_bpf module lib/test_bpf.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++++++- net/core/skbuff.c | 42 ++++++++++++++++++++++---------- 2 files changed, 99 insertions(+), 14 deletions(-) -- 2.9.5