Re: [PATCH bpf] bpf: lwt: Don't let bpf_lwt_push_encap() wrap gso_size

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Thu Nov 5, 2026 at 1:23 PM UTC, Orkun Emin Sarı via B4 Relay wrote:
> From: Orkun Emin Sarı <sariorkunemin@gmail.com>
>
> When bpf_lwt_push_encap() adds an IP header to a TCP GSO skb in
> BPF_LWT_ENCAP_IP mode, handle_gso_type() lowers gso_size by the length
> of the header. Nothing checks the result. gso_size has 16 bits, so a
> gso_size smaller than the header wraps, and one less than the header
> length gives GSO_BY_FRAGS. skb_segment() then takes the segment lengths
> from a frag_list that the skb does not have.
>
> This is the problem that commit 12d07c38e1b0 ("bpf: Don't let
> bpf_skb_adjust_room() use up the MSS") fixed for bpf_skb_adjust_room().
> As there, gso_size comes from the peer if GRO built the skb, or from the
> virtio header if it came from a tun device or a packet socket, so it can
> be as small as TCP_MIN_GSO_SIZE.
>
> Refuse the encap if less than TCP_MIN_GSO_SIZE would be left, before the
> skb is changed. Return -ENOTSUPP, as handle_gso_encap() does for GSO
> skbs it cannot handle.
>
> Found with AI-assisted code review (Claude Code).
>
> Fixes: ca78801a81e0 ("bpf: handle GSO in bpf_lwt_push_encap")
> Signed-off-by: Orkun Emin Sarı <sariorkunemin@gmail.com>
> ---
> No reproducer was run and the fix is not runtime-tested. Build-tested
> with LLVM=1 W=1 and CONFIG_LWTUNNEL_BPF=y. checkpatch prefers
> EOPNOTSUPP; ENOTSUPP is kept to match the other errors of this helper.
> ---
>  net/core/lwt_bpf.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
> index da49364ec6..c151a013a8 100644
> --- a/net/core/lwt_bpf.c
> +++ b/net/core/lwt_bpf.c
> @@ -13,6 +13,7 @@
>  #include <net/gre.h>
>  #include <net/ip.h>
>  #include <net/ip6_route.h>
> +#include <net/tcp.h>
>  
>  struct bpf_lwt_prog {
>  	struct bpf_prog *prog;
> @@ -632,6 +633,14 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
>  		return -EINVAL;
>  	}
>  
> +	/*
> +	 * The MSS is lowered by len. Leave the least that the stack lets a
> +	 * TCP GSO packet have, or gso_size can wrap.
> +	 */
> +	if (skb_is_gso(skb) &&
> +	    skb_shinfo(skb)->gso_size < len + TCP_MIN_GSO_SIZE)
> +		return -ENOTSUPP;

I think it was fixed already. If not pls share a repro
that does so on bpf and bpf-next.
pw-bot: cr