From: Maciej Żenczykowski Date: Wed, 6 May 2020 23:25:38 +0000 (-0700) Subject: [RAMEN9610-21776]ANDROID: net: bpf: permit redirect from ingress L3 to egress L2... X-Git-Url: https://git.stricted.de/?p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git;a=commitdiff_plain;h=9cc9aa28305b027e2ec9d34178e47be11223463a [RAMEN9610-21776]ANDROID: net: bpf: permit redirect from ingress L3 to egress L2 devices at near max mtu __bpf_skb_max_len(skb) is used from: bpf_skb_adjust_room __bpf_skb_change_tail __bpf_skb_change_head but in the case of forwarding we're likely calling these functions during receive processing on ingress and bpf_redirect()'ing at a later point in time to egress on another interface, thus these mtu checks are for the wrong device (input instead of output). This is particularly problematic if we're receiving on an L3 1500 mtu cellular interface, trying to add an L2 header and forwarding to an L3 mtu 1500 mtu wifi/ethernet device (which is thus L2 1514). The mtu check prevents us from adding the 14 byte ethernet header prior to forwarding the packet. After the packet has already been redirected, we'd need to add an additional 2nd ebpf program on the target device's egress tc hook, but then we'd also see non-redirected traffic and have no easy way to tell apart normal egress with ethernet header packets from forwarded ethernet headerless packets. Cc: Alexei Starovoitov Cc: Jakub Kicinski Signed-off-by: Maciej Żenczykowski Link: https://patchwork.ozlabs.org/project/netdev/patch/20200507023606.111650-1-zenczykowski@gmail.com/ But note that a more thorough solution will be pursued. Bug: 149816401 Change-Id: If55a144d7822e23bce85f65897bca7de4e0f9b24 --- diff --git a/net/core/filter.c b/net/core/filter.c index 61396648381e..549c49b63218 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2281,6 +2281,8 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff) static u32 __bpf_skb_max_len(const struct sk_buff *skb) { + if (skb_at_tc_ingress(skb) || !skb->dev) + return SKB_MAX_ALLOC; return skb->dev->mtu + skb->dev->hard_header_len; }