[PATCH net 1/1] net: lwt_bpf: preserve encap header across skb head realloc

[Ren Wei <weir@nebusec.ai>]

From: Luxiao Xu <rakukuip@gmail.com>

The BPF verifier permits an skb-backed bpf_dynptr_slice() pointer to
satisfy the helper's ARG_PTR_TO_MEM | MEM_RDONLY header argument.

In bpf_lwt_push_ip_encap(), skb_cow_head() is called to expand headroom.
If the skb headroom is insufficient or the skb is cloned,
skb_cow_head() invokes pskb_expand_head(), which allocates a new head
buffer and frees the old one. If the encapsulation header pointer hdr
points into the skb head, it becomes stale after reallocation.
Subsequent reads of iph and hdr in skb_postpush_rcsum(), UDP tunnel
header handling, and memcpy() lead to a use-after-free read.

Fix this by copying the encapsulation header into a local buffer if
hdr points into the skb head, preserving it across skb_cow_head().

Fixes: 52f278774e79 ("bpf: implement BPF_LWT_ENCAP_IP mode in bpf_lwt_push_encap")
Cc: stable@vger.kernel.org
Reported-by: VEGA <vega@nebusec.ai>
Closes: https://bugtracker.nebusec.ai/f/11304
Assisted-by: LLM
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
---
 net/core/lwt_bpf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index da49364ec63d..15b753a67452 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -604,6 +604,7 @@ static int handle_gso_encap(struct sk_buff *skb, bool ipv4, int encap_len)
 
 int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
 {
+	u8 hdr_buf[LWT_BPF_MAX_HEADROOM];
 	bool is_udp_tunnel;
 	struct iphdr *iph;
 	bool ipv4;
@@ -612,6 +613,11 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
 	if (unlikely(len < sizeof(struct iphdr) || len > LWT_BPF_MAX_HEADROOM))
 		return -EINVAL;
 
+	if ((u8 *)hdr >= skb->head && (u8 *)hdr < skb_end_pointer(skb)) {
+		memcpy(hdr_buf, hdr, len);
+		hdr = hdr_buf;
+	}
+
 	/* validate protocol and length */
 	iph = (struct iphdr *)hdr;
 	if (iph->version == 4) {
-- 
2.43.0