Re: [PATCH bpf v3 1/2] bpf: Update transport_header when encapsulating UDP tunnel in lwt

[Eric Dumazet]

On Mon, Jun 1, 2026 at 8:28 AM Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
>
> On Mon, Jun 1, 2026 at 8:03 AM Leon Hwang <leon.hwang@xxxxxxxxx> wrote:
> >
> > Currently, bpf_lwt_push_ip_encap() does not update skb->transport_header.
> > When a driver, e.g. ice, reuses the stale skb->transport_header to
> > offload checksum computation to NIC hardware, VxLAN packets encapsulated
> > by bpf_lwt_push_encap() helper may be dropped due to incorrect checksum.
> >
> > Update skb->transport_header in bpf_lwt_push_ip_encap() whenever the
> > encapsulated packet uses UDP, so checksum offload works correctly.
> >
> > Fixes: 52f278774e79 ("bpf: implement BPF_LWT_ENCAP_IP mode in bpf_lwt_push_encap")
> > Cc: Leon Hwang <leon.huangfu@xxxxxxxxxx>
> > Signed-off-by: Leon Hwang <leon.hwang@xxxxxxxxx>
> > ---
> >  net/core/lwt_bpf.c | 11 +++++++++++
> >  1 file changed, 11 insertions(+)
> >
> > diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
> > index f71ef82a5f3d..65d1dfbf3312 100644
> > --- a/net/core/lwt_bpf.c
> > +++ b/net/core/lwt_bpf.c
> > @@ -599,6 +599,7 @@ static int handle_gso_encap(struct sk_buff *skb, bool ipv4, int encap_len)
> >
> >  int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
> >  {
> > +       bool is_udp_tunnel;
> >         struct iphdr *iph;
> >         bool ipv4;
> >         int err;
> > @@ -612,10 +613,16 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
> >                 ipv4 = true;
> >                 if (unlikely(len < iph->ihl * 4))
> >                         return -EINVAL;
> > +               is_udp_tunnel = iph->protocol == IPPROTO_UDP;
> > +               if (unlikely(is_udp_tunnel && len < iph->ihl * 4 + sizeof(struct udphdr)))
> > +                       return -EINVAL;
> >         } else if (iph->version == 6) {
> >                 ipv4 = false;
> >                 if (unlikely(len < sizeof(struct ipv6hdr)))
> >                         return -EINVAL;
> > +               is_udp_tunnel = ((struct ipv6hdr *)iph)->nexthdr == NEXTHDR_UDP;
> > +               if (unlikely(is_udp_tunnel && len < sizeof(struct ipv6hdr) + sizeof(struct udphdr)))
> > +                       return -EINVAL;
> >         } else {
> >                 return -EINVAL;
> >         }
> > @@ -637,6 +644,10 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
> >         if (ingress)
> >                 skb_postpush_rcsum(skb, iph, len);
> >         skb_reset_network_header(skb);
>
> iph might point to freed memory after skb_cow_head(), leading to UAF in iph->ihl
>
> This issue is already there in the skb_postpush_rcsum(skb, iph, len) call above.

Ignore this, I missed the context about iph, which does not point to skb->head