net: Preserve metadata on pskb_expand_head

pskb_expand_head() copies headroom, including skb metadata, into the newly
allocated head, but then clears the metadata. As a result, metadata is lost
when BPF helpers trigger an skb head reallocation.

Let the skb metadata remain in the newly created copy of head.

Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20251105-skb-meta-rx-path-v4-2-5ceb08a9b37b@cloudflare.com

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 7ac5f8aa1235a55db02b40b5a0f51bb3fa53fa03..d95658b738d1935963286a9b01d7602212b7d8b0 100644 (file)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2234,6 +2234,10 @@ EXPORT_SYMBOL(__pskb_copy_fclone);
  *
  *     All the pointers pointing into skb header may change and must be
  *     reloaded after call to this function.
+ *
+ *     Note: If you skb_push() the start of the buffer after reallocating the
+ *     header, call skb_postpush_data_move() first to move the metadata out of
+ *     the way before writing to &sk_buff->data.
  */
 
 int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
@@ -2305,8 +2309,6 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
        skb->nohdr    = 0;
        atomic_set(&skb_shinfo(skb)->dataref, 1);
 
-       skb_metadata_clear(skb);
-
        /* It is not generally safe to change skb->truesize.
         * For the moment, we really care of rx path, or
         * when skb is orphaned (not attached to a socket).