Re: [PATCH net v1] bpf: lwt: Fix dst reference leak on reroute failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing pskb_may_pull() or length checks before accessing IP/IPv6 headers.
--

--- Patch [1]: [PATCH net v1] bpf: lwt: Fix dst reference leak on reroute failure ---
commit e474c43b475b276dbbb67aeaae49296dafe9f3ef
Author: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

bpf: lwt: Fix dst reference leak on reroute failure

This patch fixes a reference leak on the newly looked up dst in
bpf_lwt_xmit_reroute(). When skb_cow_head() fails, the error path
now correctly releases the new dst reference before freeing the skb.

Cc: stable@vger.kernel.org

> diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
> index bf588f508b79e..652952d416f23 100644
> --- a/net/core/lwt_bpf.c
> +++ b/net/core/lwt_bpf.c
[ ... ]
> @@ -255,8 +255,10 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
>  	 * if there is enough header space in skb.
>  	 */
>  	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
> -	if (unlikely(err))
> +	if (unlikely(err)) {
> +		dst_release(dst);
>  		goto err;
> +	}
>  
>  	skb_dst_drop(skb);
>  	skb_dst_set(skb, dst);

[Severity: High]
This isn't a bug introduced by this patch, but there is a pre-existing issue
in bpf_lwt_xmit_reroute() and bpf_lwt_input_reroute() regarding missing header
length checks.

If a BPF program attached to lwtunnel (e.g., BPF_PROG_TYPE_LWT_XMIT or LWT_IN)
shrinks the packet via bpf_skb_change_tail() such that the linear data length
is less than the IPv4/IPv6 header size, and returns BPF_LWT_REROUTE, the
kernel unconditionally accesses the packet headers.

In bpf_lwt_xmit_reroute():

    if (ipv4) {
        struct iphdr *iph = ip_hdr(skb);
        ...
        fl4.daddr = iph->daddr;
        fl4.saddr = iph->saddr;

In bpf_lwt_input_reroute():

    if (skb->protocol == htons(ETH_P_IP)) {
        struct iphdr *iph = ip_hdr(skb);
        ...
        reason = ip_route_input_noref(skb, iph->daddr, iph->saddr,
                                      ip4h_dscp(iph), dev);

Does this sequence cause an out-of-bounds memory read (info leak or Oops) when
dereferencing iph->daddr or iph->saddr, since there is no verification that
skb->len >= sizeof(struct iphdr) or a call to pskb_may_pull()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723060445.21926-1-xuanqiang.luo@linux.dev?part=1