CVE-2025-68363

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check skb->transport_header is set in bpf_skb_check_mtu

The bpf_skb_check_mtu helper needs to use skb->transport_header when

the BPF_MTU_CHK_SEGS flag is used:

bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS)

The transport_header is not always set. There is a WARN_ON_ONCE

report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set +

bpf_prog_test_run is used:

WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071

skb_gso_validate_network_len

bpf_skb_check_mtu

bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch

bpf_test_run

bpf_prog_test_run_skb

For a normal ingress skb (not test_run), skb_reset_transport_header

is performed but there is plan to avoid setting it as described in

commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()").

This patch fixes the bpf helper by checking

skb_transport_header_was_set(). The check is done just before

skb->transport_header is used, to avoid breaking the existing bpf prog.

The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.