Re: [PATCH net 1/1] net: lwt_bpf: preserve encap header across skb head realloc

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Fri, Oct 09, 2026 at 12:59 AM Ren Wei <weir@nebusec.ai> wrote:
> The BPF verifier permits an skb-backed bpf_dynptr_slice() pointer to
> satisfy the helper's ARG_PTR_TO_MEM | MEM_RDONLY header argument.

That's the bug. Fix it there.
PTR_TO_PACKET is rejected as 'hdr', since the helper doesn't have
pkt_access. None of the helpers in bpf_helper_changes_pkt_data() do.
The slice of skb dynptr is the same memory, but it's PTR_TO_MEM
and check_helper_mem_access() lets it through.

> Fixes: 52f278774e79 ("bpf: implement BPF_LWT_ENCAP_IP mode in bpf_lwt_push_encap")

Wrong tag. There was no way to pass skb memory into this helper before
commit 66e3a13e7c2c ("bpf: Add bpf_dynptr_slice and bpf_dynptr_slice_rdwr").

> +	if ((u8 *)hdr >= skb->head && (u8 *)hdr < skb_end_pointer(skb)) {
> +		memcpy(hdr_buf, hdr, len);
> +		hdr = hdr_buf;
> +	}

Patching it in one spot doesn't help.
BPF_LWT_ENCAP_SEG6 mode of the same helper does skb_cow_head() and then
memcpy(isrh, osrh, hdrlen) in __seg6_do_srh_encap().
bpf_skb_store_bytes() does bpf_try_make_writable() and then
memcpy(ptr, from, len). When offset is in frags __pskb_pull_tail()
reallocates the head and 'from' is stale.
bpf_dynptr_write() into skb dynptr and the rest of seg6 helpers
are the same.

Reject reg_is_dynptr_slice_pkt() arguments in the helpers that
change packet data.
commit a6c1edfbe240 ("bpf: Reject pkt arguments in mutating subprogs")
did that for global subprogs.
ing_cls_dynptr_write() in test_xdp_meta.c will need an update.

Add a selftest and target bpf-next tree instead of net.

pw-bot: cr