Re: [PATCH bpf v3 1/2] bpf: Update transport_header when encapsulating UDP tunnel in lwt

[Eric Dumazet]

On Mon, Jun 1, 2026 at 8:03 AM Leon Hwang <leon.hw...@linux.dev> wrote:
>
> Currently, bpf_lwt_push_ip_encap() does not update skb->transport_header.
> When a driver, e.g. ice, reuses the stale skb->transport_header to
> offload checksum computation to NIC hardware, VxLAN packets encapsulated
> by bpf_lwt_push_encap() helper may be dropped due to incorrect checksum.
>
> Update skb->transport_header in bpf_lwt_push_ip_encap() whenever the
> encapsulated packet uses UDP, so checksum offload works correctly.
>
> Fixes: 52f278774e79 ("bpf: implement BPF_LWT_ENCAP_IP mode in 
> bpf_lwt_push_encap")
> Cc: Leon Hwang <leon.huan...@shopee.com>
> Signed-off-by: Leon Hwang <leon.hw...@linux.dev>
> ---
>  net/core/lwt_bpf.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
>
> diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
> index f71ef82a5f3d..65d1dfbf3312 100644
> --- a/net/core/lwt_bpf.c
> +++ b/net/core/lwt_bpf.c
> @@ -599,6 +599,7 @@ static int handle_gso_encap(struct sk_buff *skb, bool 
> ipv4, int encap_len)
>
>  int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool 
> ingress)
>  {
> +       bool is_udp_tunnel;
>         struct iphdr *iph;
>         bool ipv4;
>         int err;
> @@ -612,10 +613,16 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void 
> *hdr, u32 len, bool ingress)
>                 ipv4 = true;
>                 if (unlikely(len < iph->ihl * 4))
>                         return -EINVAL;
> +               is_udp_tunnel = iph->protocol == IPPROTO_UDP;
> +               if (unlikely(is_udp_tunnel && len < iph->ihl * 4 + 
> sizeof(struct udphdr)))
> +                       return -EINVAL;
>         } else if (iph->version == 6) {
>                 ipv4 = false;
>                 if (unlikely(len < sizeof(struct ipv6hdr)))
>                         return -EINVAL;
> +               is_udp_tunnel = ((struct ipv6hdr *)iph)->nexthdr == 
> NEXTHDR_UDP;
> +               if (unlikely(is_udp_tunnel && len < sizeof(struct ipv6hdr) + 
> sizeof(struct udphdr)))
> +                       return -EINVAL;
>         } else {
>                 return -EINVAL;
>         }
> @@ -637,6 +644,10 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void 
> *hdr, u32 len, bool ingress)
>         if (ingress)
>                 skb_postpush_rcsum(skb, iph, len);
>         skb_reset_network_header(skb);

iph might point to freed memory after skb_cow_head(), leading to UAF in iph->ihl

This issue is already there in the skb_postpush_rcsum(skb, iph, len) call above.

> +       if (ipv4 && is_udp_tunnel)
> +               skb_set_transport_header(skb, skb_network_offset(skb) + 
> iph->ihl * 4);
> +       else if (!ipv4 && is_udp_tunnel)
> +               skb_set_transport_header(skb, skb_network_offset(skb) + 
> sizeof(struct ipv6hdr));
>         memcpy(skb_network_header(skb), hdr, len);
>         bpf_compute_data_pointers(skb);
>         skb_clear_hash(skb);
> --
> 2.54.0
>