[PATCH net v1] bpf: lwt: Fix dst reference leak on reroute failure

[PATCH net v1] bpf: lwt: Fix dst reference leak on reroute failure

[xuanqiang.luo]

From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

bpf_lwt_xmit_reroute() obtains a referenced dst from the route
lookup. When skb_cow_head() fails before that dst is installed on the
skb, the error path only frees the skb. The skb still owns its previous
dst, so the newly looked up dst reference is leaked.

Release the new dst reference before freeing the skb on this error
path.

Fixes: 3bd0b15281af ("bpf: add handling of BPF_LWT_REROUTE to lwt_bpf.c")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
---
 net/core/lwt_bpf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index bf588f508b79e..652952d416f23 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -255,8 +255,10 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
 	 * if there is enough header space in skb.
 	 */
 	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
-	if (unlikely(err))
+	if (unlikely(err)) {
+		dst_release(dst);
 		goto err;
+	}
 
 	skb_dst_drop(skb);
 	skb_dst_set(skb, dst);
-- 
2.43.0

Re: [PATCH net v1] bpf: lwt: Fix dst reference leak on reroute failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing pskb_may_pull() or length checks before accessing IP/IPv6 headers.
--

--- Patch [1]: [PATCH net v1] bpf: lwt: Fix dst reference leak on reroute failure ---
commit e474c43b475b276dbbb67aeaae49296dafe9f3ef
Author: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

bpf: lwt: Fix dst reference leak on reroute failure

This patch fixes a reference leak on the newly looked up dst in
bpf_lwt_xmit_reroute(). When skb_cow_head() fails, the error path
now correctly releases the new dst reference before freeing the skb.

Cc: stable@vger.kernel.org

> diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
> index bf588f508b79e..652952d416f23 100644
> --- a/net/core/lwt_bpf.c
> +++ b/net/core/lwt_bpf.c
[ ... ]
> @@ -255,8 +255,10 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
>  	 * if there is enough header space in skb.
>  	 */
>  	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
> -	if (unlikely(err))
> +	if (unlikely(err)) {
> +		dst_release(dst);
>  		goto err;
> +	}
>  
>  	skb_dst_drop(skb);
>  	skb_dst_set(skb, dst);

[Severity: High]
This isn't a bug introduced by this patch, but there is a pre-existing issue
in bpf_lwt_xmit_reroute() and bpf_lwt_input_reroute() regarding missing header
length checks.

If a BPF program attached to lwtunnel (e.g., BPF_PROG_TYPE_LWT_XMIT or LWT_IN)
shrinks the packet via bpf_skb_change_tail() such that the linear data length
is less than the IPv4/IPv6 header size, and returns BPF_LWT_REROUTE, the
kernel unconditionally accesses the packet headers.

In bpf_lwt_xmit_reroute():

    if (ipv4) {
        struct iphdr *iph = ip_hdr(skb);
        ...
        fl4.daddr = iph->daddr;
        fl4.saddr = iph->saddr;

In bpf_lwt_input_reroute():

    if (skb->protocol == htons(ETH_P_IP)) {
        struct iphdr *iph = ip_hdr(skb);
        ...
        reason = ip_route_input_noref(skb, iph->daddr, iph->saddr,
                                      ip4h_dscp(iph), dev);

Does this sequence cause an out-of-bounds memory read (info leak or Oops) when
dereferencing iph->daddr or iph->saddr, since there is no verification that
skb->len >= sizeof(struct iphdr) or a call to pskb_may_pull()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723060445.21926-1-xuanqiang.luo@linux.dev?part=1