Re: [PATCH bpf v2] bpf: disallow bpf_skb_pull_data() for LWT_SEG6LOCAL

Hello:

This patch was applied to bpf/bpf.git (master)
by Daniel Borkmann [off-list ref]:

On Wed,  9 Sep 2026 12:08:08 +0800 you wrote:

An LWT_SEG6LOCAL program can invalidate its cached SRH with
bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter
may reallocate skb->head, leaving the per-CPU SRH pointer dangling.
Post-program SRH validation then writes through that pointer.

Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier
rejects this unsafe helper combination. Other LWT program types continue
to expose the helper through lwt_out_func_proto().

[...]

Here is the summary with links:
  - [bpf,v2] bpf: disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
    https://git.kernel.org/bpf/bpf/c/e4a62833adff

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html