Re: [PATCH v6 4/6] bpf: allow new DECAP flags and add guard rails

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Omitting the L3 decapsulation mask bypasses skb_dst_drop(), leaving the decapsulated inner packet with the outer tunnel's routing destination.
--

commit 65429a5bdf5c795afb0af1f3ce1b31c6d08218f7
Author: Nick Hudson <nhudson@akamai.com>

bpf: allow new DECAP flags and add guard rails

Add checks to require shrink-only decap, reject conflicting decap flag
combinations, and verify removed length is sufficient for claimed header
decapsulation.

> diff --git a/net/core/filter.c b/net/core/filter.c
> index 1a96d0af1704..04871a57f085 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -3484,6 +3485,12 @@ static u32 bpf_skb_net_base_len(const struct sk_buff *skb)
>  #define BPF_F_ADJ_ROOM_DECAP_L3_MASK	(BPF_F_ADJ_ROOM_DECAP_L3_IPV4 | \
>  					 BPF_F_ADJ_ROOM_DECAP_L3_IPV6)
>  
> +#define BPF_F_ADJ_ROOM_DECAP_L4_MASK	(BPF_F_ADJ_ROOM_DECAP_L4_UDP | \
> +					 BPF_F_ADJ_ROOM_DECAP_L4_GRE)

Does omitting the L3 decapsulation mask bypass skb_dst_drop()?

In bpf_skb_net_shrink(), dropping the stale routing destination cache is
gated by the L3 mask:

    bool decap = flags & BPF_F_ADJ_ROOM_DECAP_L3_MASK;
    ...
    if (decap) {
        ...
        if (skb_valid_dst(skb))
            skb_dst_drop(skb);
    }

The UAPI documentation states that L3 decap flags are "Used when the inner
and outer IP versions are different". This instructs users to omit the L3
flag when decapsulating a tunnel with identical inner and outer IP versions.

If a BPF program follows this and uses BPF_F_ADJ_ROOM_DECAP_L4_UDP without
providing an L3 decap flag, decap evaluates to false.

Could this bypass skb_dst_drop(skb) and cause the newly decapsulated inner
packet to incorrectly inherit the outer tunnel's dst_entry, routing it to
the tunnel endpoint instead of its true destination?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260504101759.3319427-1-nhudson@akamai.com?part=4