[PATCH bpf] bpf: lwt: Don't let bpf_lwt_push_encap() wrap gso_size

[PATCH bpf] bpf: lwt: Don't let bpf_lwt_push_encap() wrap gso_size

[Orkun Emin Sarı via B4 Relay]

From: Orkun Emin Sarı <sariorkunemin@gmail.com>

When bpf_lwt_push_encap() adds an IP header to a TCP GSO skb in
BPF_LWT_ENCAP_IP mode, handle_gso_type() lowers gso_size by the length
of the header. Nothing checks the result. gso_size has 16 bits, so a
gso_size smaller than the header wraps, and one less than the header
length gives GSO_BY_FRAGS. skb_segment() then takes the segment lengths
from a frag_list that the skb does not have.

This is the problem that commit 12d07c38e1b0 ("bpf: Don't let
bpf_skb_adjust_room() use up the MSS") fixed for bpf_skb_adjust_room().
As there, gso_size comes from the peer if GRO built the skb, or from the
virtio header if it came from a tun device or a packet socket, so it can
be as small as TCP_MIN_GSO_SIZE.

Refuse the encap if less than TCP_MIN_GSO_SIZE would be left, before the
skb is changed. Return -ENOTSUPP, as handle_gso_encap() does for GSO
skbs it cannot handle.

Found with AI-assisted code review (Claude Code).

Fixes: ca78801a81e0 ("bpf: handle GSO in bpf_lwt_push_encap")
Signed-off-by: Orkun Emin Sarı <sariorkunemin@gmail.com>
---
No reproducer was run and the fix is not runtime-tested. Build-tested
with LLVM=1 W=1 and CONFIG_LWTUNNEL_BPF=y. checkpatch prefers
EOPNOTSUPP; ENOTSUPP is kept to match the other errors of this helper.
---
 net/core/lwt_bpf.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index da49364ec6..c151a013a8 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -13,6 +13,7 @@
 #include <net/gre.h>
 #include <net/ip.h>
 #include <net/ip6_route.h>
+#include <net/tcp.h>
 
 struct bpf_lwt_prog {
 	struct bpf_prog *prog;
@@ -632,6 +633,14 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
 		return -EINVAL;
 	}
 
+	/*
+	 * The MSS is lowered by len. Leave the least that the stack lets a
+	 * TCP GSO packet have, or gso_size can wrap.
+	 */
+	if (skb_is_gso(skb) &&
+	    skb_shinfo(skb)->gso_size < len + TCP_MIN_GSO_SIZE)
+		return -ENOTSUPP;
+
 	if (ingress)
 		err = skb_cow_head(skb, len + skb->mac_len);
 	else

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261105-bpf-lwt-gso-7f50be81ccf8

Best regards,
--  
Orkun Emin Sarı <sariorkunemin@gmail.com>

Re: [PATCH bpf] bpf: lwt: Don't let bpf_lwt_push_encap() wrap gso_size

[Alexei Starovoitov]

On Thu Nov 5, 2026 at 1:23 PM UTC, Orkun Emin Sarı via B4 Relay wrote:
> From: Orkun Emin Sarı <sariorkunemin@gmail.com>
>
> When bpf_lwt_push_encap() adds an IP header to a TCP GSO skb in
> BPF_LWT_ENCAP_IP mode, handle_gso_type() lowers gso_size by the length
> of the header. Nothing checks the result. gso_size has 16 bits, so a
> gso_size smaller than the header wraps, and one less than the header
> length gives GSO_BY_FRAGS. skb_segment() then takes the segment lengths
> from a frag_list that the skb does not have.
>
> This is the problem that commit 12d07c38e1b0 ("bpf: Don't let
> bpf_skb_adjust_room() use up the MSS") fixed for bpf_skb_adjust_room().
> As there, gso_size comes from the peer if GRO built the skb, or from the
> virtio header if it came from a tun device or a packet socket, so it can
> be as small as TCP_MIN_GSO_SIZE.
>
> Refuse the encap if less than TCP_MIN_GSO_SIZE would be left, before the
> skb is changed. Return -ENOTSUPP, as handle_gso_encap() does for GSO
> skbs it cannot handle.
>
> Found with AI-assisted code review (Claude Code).
>
> Fixes: ca78801a81e0 ("bpf: handle GSO in bpf_lwt_push_encap")
> Signed-off-by: Orkun Emin Sarı <sariorkunemin@gmail.com>
> ---
> No reproducer was run and the fix is not runtime-tested. Build-tested
> with LLVM=1 W=1 and CONFIG_LWTUNNEL_BPF=y. checkpatch prefers
> EOPNOTSUPP; ENOTSUPP is kept to match the other errors of this helper.
> ---
>  net/core/lwt_bpf.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>
> diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
> index da49364ec6..c151a013a8 100644
> --- a/net/core/lwt_bpf.c
> +++ b/net/core/lwt_bpf.c
> @@ -13,6 +13,7 @@
>  #include <net/gre.h>
>  #include <net/ip.h>
>  #include <net/ip6_route.h>
> +#include <net/tcp.h>
>  
>  struct bpf_lwt_prog {
>  	struct bpf_prog *prog;
> @@ -632,6 +633,14 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
>  		return -EINVAL;
>  	}
>  
> +	/*
> +	 * The MSS is lowered by len. Leave the least that the stack lets a
> +	 * TCP GSO packet have, or gso_size can wrap.
> +	 */
> +	if (skb_is_gso(skb) &&
> +	    skb_shinfo(skb)->gso_size < len + TCP_MIN_GSO_SIZE)
> +		return -ENOTSUPP;

I think it was fixed already. If not pls share a repro
that does so on bpf and bpf-next.
pw-bot: cr