Re: [PATCH v1 bpf-next/net 3/5] bpf: Add bpf_skb_set_hwtstamp().

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unsafe modification of shared SKB data (skb_shinfo) via insufficient uncloning
--

commit 96bf1885d42f4593da3e164388ab66653eb4e518
Author: Kuniyuki Iwashima <kuniyu@google.com>

bpf: Add bpf_skb_set_hwtstamp().

Adds a kfunc to update skb_hwtstamps(skb)->hwtstamp at tc/ingress. This
allows transparent proxying of RX hardware timestamps via SCM_TIMESTAMPING to
socket applications.

> diff --git a/net/core/filter.c b/net/core/filter.c
> index acdc66aa4f27c..ab7adef9c0159 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c

[ ... ]

> @@ -12372,6 +12372,28 @@ __bpf_kfunc int bpf_sock_ops_enable_tx_tstamp(struct bpf_sock_ops_kern *skops,
>  	return 0;
>  }
>  
> +__bpf_kfunc int bpf_skb_set_hwtstamp(struct __sk_buff *s,
> +				     struct bpf_hwtstamp *attrs, int attrs__sz)
> +{
> +	struct sk_buff *skb = (struct sk_buff *)s;
> +
> +	if (attrs__sz != sizeof(*attrs) || attrs->reserved)
> +		return -EINVAL;
> +
> +	if (!skb_at_tc_ingress(skb))
> +		return -EINVAL;
> +
> +	if (skb_header_unclone(skb, GFP_ATOMIC))
> +		return -ENOMEM;
> +
> +	skb_clear_tstamp(skb);
> +	skb_hwtstamps(skb)->hwtstamp = attrs->hwtstamp;

[Severity: High]
Does using skb_header_unclone() safely protect against modifying a shared
skb_shinfo(skb) here?

For TCP transmit clones, the header is released and skb->nohdr is set to 1.
This makes skb_header_cloned() return false, even though the data buffer and
skb_shinfo are still shared with the original packet in the TCP write queue.

When these packets loop back to TC ingress, such as via veth or loopback,
and are modified by the BPF program, skb_header_unclone() will skip
reallocation.

Could this lead to silent data corruption of the original socket buffer's
skb_shinfo? Would using skb_unclone() instead be necessary to prevent this?

> +
> +	bpf_compute_data_pointers(skb);
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260612001803.23341-1-kuniyu@google.com?part=3