Currently, bpf_lwt_push_ip_encap() does not update skb->transport_header.
When a driver, e.g. ice, reuses the stale skb->transport_header to
offload checksum computation to NIC hardware, VxLAN packets encapsulated
by bpf_lwt_push_encap() helper may be dropped due to incorrect checksum.
Update skb->transport_header in bpf_lwt_push_ip_encap() whenever the
encapsulated packet uses UDP, so checksum offload works correctly.
Fixes: 52f278774e79 ("bpf: implement BPF_LWT_ENCAP_IP mode in
bpf_lwt_push_encap")
Cc: Leon Hwang <[email protected]>
Signed-off-by: Leon Hwang <[email protected]>
---
net/core/lwt_bpf.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index c306120e11d2..1d556dec94b4 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -600,6 +600,7 @@ static int handle_gso_encap(struct sk_buff *skb, bool ipv4,
int encap_len)
int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool
ingress)
{
u8 buff[LWT_BPF_MAX_HEADROOM];
+ bool is_udp_tunnel;
struct iphdr *iph;
bool ipv4;
int err;
@@ -615,10 +616,16 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr,
u32 len, bool ingress)
ipv4 = true;
if (unlikely(iph->ihl < 5 || len < iph->ihl * 4))
return -EINVAL;
+ is_udp_tunnel = iph->protocol == IPPROTO_UDP;
+ if (unlikely(is_udp_tunnel && len < iph->ihl * 4 +
sizeof(struct udphdr)))
+ return -EINVAL;
} else if (iph->version == 6) {
ipv4 = false;
if (unlikely(len < sizeof(struct ipv6hdr)))
return -EINVAL;
+ is_udp_tunnel = ((struct ipv6hdr *)iph)->nexthdr == NEXTHDR_UDP;
+ if (unlikely(is_udp_tunnel && len < sizeof(struct ipv6hdr) +
sizeof(struct udphdr)))
+ return -EINVAL;
} else {
return -EINVAL;
}
@@ -641,6 +648,10 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr,
u32 len, bool ingress)
skb_postpush_rcsum(skb, iph, len);
skb_reset_network_header(skb);
memcpy(skb_network_header(skb), buff, len);
+ if (ipv4 && is_udp_tunnel)
+ skb_set_transport_header(skb, skb_network_offset(skb) +
iph->ihl * 4);
+ else if (!ipv4 && is_udp_tunnel)
+ skb_set_transport_header(skb, skb_network_offset(skb) +
sizeof(struct ipv6hdr));
bpf_compute_data_pointers(skb);
skb_clear_hash(skb);
--
2.54.0
