Re: [PATCH bpf v3] bpf: Fix non-linear SRH access in bpf_update_srh_state()

[Cen Zhang (Microsoft Security FORGE Labs)]

On Sun, Sep 13, 2026 at 9:56 PM Alexei Starovoitov
<alexei.starovoitov@xxxxxxxxx> wrote:
> > +       srh = seg6_get_srh(skb, 0);
> > +       bpf_compute_data_pointers(skb);
> > +       srh_state->srh = srh;
> > +       if (!srh)
> > +               return;
> > +
> > +       srh_state->hdrlen = srh->hdrlen << 3;
> > +       srh_state->valid = true;
>
> This is not equivalent.

Thank you for pointing this out. seg6_get_srh() additionally
validates the header. I will revert to ipv6_find_hdr() in v4.

Thanks,
Cen