Re: [PATCH net-next v1 07/15] bpf: don't redirect decrypted skbs from egress to ingress

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] bpf: non-standard multi-line comment style in __bpf_redirect()
--

commit a5cc3bc1e6d8f72d0aefee8fc281286777a450a4
Author: Todd Freed <toddfreed@meta.com>

bpf: don't redirect decrypted skbs from egress to ingress

This commit drops packets with skb->decrypted set when BPF redirects them
from egress to ingress in __bpf_redirect().

> diff --git a/net/core/filter.c b/net/core/filter.c
> index aca8160b26a1a..a178a9dd30070 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -2226,6 +2226,15 @@ static int __bpf_redirect_common(struct sk_buff *skb, struct net_device *dev,
>  static int __bpf_redirect(struct sk_buff *skb, struct net_device *dev,
>  			  u32 flags)
>  {
> +	/* On transmit, decrypted asks the device to encrypt the packet. Sent
> +	 * to ingress, the packet would read as decrypted by the device.
> +	 */

[Severity: Low]
This isn't a bug, but BPF code uses the multi-line comment style with the
opening /* on its own line.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111005533.6436-1-toddfreed@meta.com?part=7