bpf: Update transport_header when encapsulating UDP tunnel in lwt

Currently, bpf_lwt_push_ip_encap() does not update skb->transport_header.
When a driver, e.g. ice, reuses the stale skb->transport_header to
offload checksum computation to NIC hardware, VxLAN packets encapsulated
by bpf_lwt_push_encap() helper may be dropped due to incorrect checksum.

Update skb->transport_header in bpf_lwt_push_ip_encap() whenever the
encapsulated packet uses UDP, so checksum offload works correctly.

Fixes: 52f278774e79 ("bpf: implement BPF_LWT_ENCAP_IP mode in bpf_lwt_push_encap")
Cc: Leon Hwang <leon.huangfu@shopee.com>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/r/20260602150931.49629-2-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index f71ef82a5f3d366757fb52c71dccf54a2e490fbf..bf588f508b79e68f8857fc6a9ff30cd2d085bdec 100644 (file)
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -599,6 +599,7 @@ static int handle_gso_encap(struct sk_buff *skb, bool ipv4, int encap_len)
 
 int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
 {
+       bool is_udp_tunnel;
        struct iphdr *iph;
        bool ipv4;
        int err;
@@ -612,10 +613,16 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
                ipv4 = true;
                if (unlikely(len < iph->ihl * 4))
                        return -EINVAL;
+               is_udp_tunnel = iph->protocol == IPPROTO_UDP;
+               if (unlikely(is_udp_tunnel && len < iph->ihl * 4 + sizeof(struct udphdr)))
+                       return -EINVAL;
        } else if (iph->version == 6) {
                ipv4 = false;
                if (unlikely(len < sizeof(struct ipv6hdr)))
                        return -EINVAL;
+               is_udp_tunnel = ((struct ipv6hdr *)iph)->nexthdr == NEXTHDR_UDP;
+               if (unlikely(is_udp_tunnel && len < sizeof(struct ipv6hdr) + sizeof(struct udphdr)))
+                       return -EINVAL;
        } else {
                return -EINVAL;
        }
@@ -637,6 +644,11 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
        if (ingress)
                skb_postpush_rcsum(skb, iph, len);
        skb_reset_network_header(skb);
+       if (is_udp_tunnel) {
+               size_t iph_sz = ipv4 ? iph->ihl * 4 : sizeof(struct ipv6hdr);
+
+               skb_set_transport_header(skb, skb_network_offset(skb) + iph_sz);
+       }
        memcpy(skb_network_header(skb), hdr, len);
        bpf_compute_data_pointers(skb);
        skb_clear_hash(skb);