The skbuff BUG_ON() conversions left a few comments behind: - bpf_skb_net_grow() says skb_segment() BUG()s on a frag_list with head_frag set at the downgraded MSS. It fails the segmentation and the packet is dropped, which is still why the skb gets linearized. - The skb_to_sgvec() kernel-doc doesn't list the -EINVAL that __skb_to_sgvec() returns when @offset and @len run past the end of the skb. No functional change. Acked-by: Mina Almasry Assisted-by: LLM Signed-off-by: Josef Bacik --- net/core/filter.c | 6 +++--- net/core/skbuff.c | 5 +++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 3ee1a093337e..f5bce0dc43fe 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -3696,9 +3696,9 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff, shinfo->gso_segs = 0; /* Due to header growth, MSS needs to be downgraded. - * There is a BUG_ON() when segmenting the frag_list with - * head_frag true, so linearize the skb after downgrading - * the MSS. + * Segmenting a frag_list with head_frag true at the new MSS + * fails and the packet gets dropped, so linearize the skb + * after downgrading the MSS. */ if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) { skb_decrease_gso_size(shinfo, len_diff); diff --git a/net/core/skbuff.c b/net/core/skbuff.c index c5e28a52114b..e0c8f2f6bfac 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -5551,8 +5551,9 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len, * * Fill the specified scatter-gather list with mappings/pointers into a * region of the buffer space attached to a socket buffer. Returns either - * the number of scatterlist items used, or -EMSGSIZE if the contents - * could not fit. + * the number of scatterlist items used, -EMSGSIZE if the contents + * could not fit, or -EINVAL if @offset and @len run past the end of + * the skb. */ int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len) { -- 2.55.0