Patch "bpf: Check negative offsets in __bpf_skb_min_len()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Check negative offsets in __bpf_skb_min_len()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-check-negative-offsets-in-__bpf_skb_min_len.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b7d7c0f895b83ebac04fd3704d2c8573b5b376e9
Author: Cong Wang <cong.wang@xxxxxxxxxxxxx>
Date:   Thu Dec 12 19:40:54 2024 -0800

    bpf: Check negative offsets in __bpf_skb_min_len()
    
    [ Upstream commit 9ecc4d858b92c1bb0673ad9c327298e600c55659 ]
    
    skb_network_offset() and skb_transport_offset() can be negative when
    they are called after we pull the transport header, for example, when
    we use eBPF sockmap at the point of ->sk_data_ready().
    
    __bpf_skb_min_len() uses an unsigned int to get these offsets, this
    leads to a very large number which then causes bpf_skb_change_tail()
    failed unexpectedly.
    
    Fix this by using a signed int to get these offsets and ensure the
    minimum is at least zero.
    
    Fixes: 5293efe62df8 ("bpf: add bpf_skb_change_tail helper")
    Signed-off-by: Cong Wang <cong.wang@xxxxxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: John Fastabend <john.fastabend@xxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20241213034057.246437-2-xiyou.wangcong@xxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/filter.c b/net/core/filter.c
index e35d86ba00e2..d6042d285aa2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3683,13 +3683,22 @@ static const struct bpf_func_proto bpf_skb_adjust_room_proto = {
 
 static u32 __bpf_skb_min_len(const struct sk_buff *skb)
 {
-	u32 min_len = skb_network_offset(skb);
+	int offset = skb_network_offset(skb);
+	u32 min_len = 0;
 
-	if (skb_transport_header_was_set(skb))
-		min_len = skb_transport_offset(skb);
-	if (skb->ip_summed == CHECKSUM_PARTIAL)
-		min_len = skb_checksum_start_offset(skb) +
-			  skb->csum_offset + sizeof(__sum16);
+	if (offset > 0)
+		min_len = offset;
+	if (skb_transport_header_was_set(skb)) {
+		offset = skb_transport_offset(skb);
+		if (offset > 0)
+			min_len = offset;
+	}
+	if (skb->ip_summed == CHECKSUM_PARTIAL) {
+		offset = skb_checksum_start_offset(skb) +
+			 skb->csum_offset + sizeof(__sum16);
+		if (offset > 0)
+			min_len = offset;
+	}
 	return min_len;
 }