Re: [PATCH net 1/1] net: lwt_bpf: preserve encap header across skb head realloc

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] bpf: CHECKSUM_COMPLETE corruption on IPv4 encap push
--

commit ab70bb57bdb2ff3156beb5d15952b833dad5b175
Author: Luxiao Xu <rakukuip@gmail.com>

net: lwt_bpf: preserve encap header across skb head realloc

This commit addresses a use-after-free read in BPF LWT encapsulation. It
copies the encapsulation header into a local buffer if it points into the
skb head, preserving it across head reallocation.

Closes: https://bugtracker.nebusec.ai/f/11304

> diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
> --- a/net/core/lwt_bpf.c
> +++ b/net/core/lwt_bpf.c
[ ... ]
> @@ -612,6 +613,11 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
>  	if (unlikely(len < sizeof(struct iphdr) || len > LWT_BPF_MAX_HEADROOM))
>  		return -EINVAL;
>  
> +	if ((u8 *)hdr >= skb->head && (u8 *)hdr < skb_end_pointer(skb)) {
> +		memcpy(hdr_buf, hdr, len);
> +		hdr = hdr_buf;
> +	}
> +
>  	/* validate protocol and length */
>  	iph = (struct iphdr *)hdr;
>  	if (iph->version == 4) {

[Severity: Medium]
Does this sequence of operations corrupt CHECKSUM_COMPLETE on IPv4
encap push?

When bpf_lwt_push_ip_encap() executes on ingress, it calls
skb_postpush_rcsum() on the user-provided hdr buffer where iph->check is 0:

	if (ingress)
		skb_postpush_rcsum(skb, iph, len);

This calculates the partial checksum of the header and adds it to
skb->csum. Later in the function, the header is modified in the packet
buffer to contain the correct checksum:

	if (ipv4) {
		skb->protocol = htons(ETH_P_IP);
		iph = ip_hdr(skb);

		if (!iph->check)
			iph->check = ip_fast_csum((unsigned char *)iph,
						  iph->ihl);
	}

Since a valid IPv4 header sums to 0, pushing it should result in a net 0
addition to skb->csum. However, skb->csum retains the non-zero addition
from the earlier calculation and is never updated to compensate for the
iph->check data mutation.

Could this cause skb->csum to go out of sync with the packet payload,
leading to netdev_rx_csum_fault warnings and packet drops when upper
layers validate the checksum?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1791433504.git.rakukuip@gmail.com?part=1