[PATCH v3 0/3] bpf: clear stale IPv4 options after LWT encapsulation

[Weiming Shi]

This series implements the post-run CB reset suggested by Daniel, reuses the
existing save/restore wrapper, and propagates cb_access from freplace
programs before their activation.

Patch 1 handles freplace cb_access propagation. Patch 2 marks successful LWT
IP header pushes and resets the restored protocol CB after the program runs.
Patch 3 contains the selftests, covering direct and freplace CB access, VRF
ingress, and packets already marked encapsulated before entering LWT.

Changes since v2:
- Replace the LWT state tracking and extra CB copy with a post-run reset after
  bpf_prog_run_save_cb() restores the protocol control block.
- Propagate cb_access from freplace programs in a separate prerequisite patch.
- Mark only successful BPF_LWT_ENCAP_IP pushes, covering packets already
  marked encapsulated without treating failed SEG6 operations as completed
  header replacements.
- Select the reset layout from the protocol callback which next consumes the
  packet, preserving ingress interface and L3-slave state across family
  changes and initializing the IPv6 network-header offset.
- Save and restore the marker around nested LWT runs.
- Add selftests for direct and freplace CB access, VRF ingress, and packets
  already marked encapsulated before entering LWT.

Validation: the full KASAN+BTF kernel build passes. All five selftest cases
pass with none skipped and no KASAN report, Oops, or panic. The new
already-encapsulated case fails on the earlier transition-based implementation
and passes with this series.

Previous version:
https://lore.kernel.org/bpf/20260916170406.1280954-2-bestswngs@xxxxxxxxx/

Review discussion:
https://lore.kernel.org/bpf/48990076-414c-4196-99b9-86fce41b8054@xxxxxxxxxxxxx/
https://lore.kernel.org/bpf/97695bef-507a-403a-84ae-c2e222b3dc65@xxxxxxxxxxxxx/

Weiming Shi (3):
  bpf: propagate cb_access from freplace programs
  bpf: clear stale IPv4 options after LWT encapsulation
  selftests/bpf: cover stale CB after LWT IP encapsulation

 include/linux/bpf.h                           |   2 +-
 include/linux/filter.h                        |   8 +-
 kernel/bpf/syscall.c                          |   6 +
 net/core/lwt_bpf.c                            |  47 +++
 .../selftests/bpf/prog_tests/lwt_ip_encap.c   | 288 ++++++++++++++++++
 .../bpf/progs/lwt_ip_encap_stale_cb.c         | 100 ++++++
 .../progs/lwt_ip_encap_stale_cb_freplace.c    |  32 ++
 7 files changed, 479 insertions(+), 4 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/progs/lwt_ip_encap_stale_cb.c
 create mode 100644 tools/testing/selftests/bpf/progs/lwt_ip_encap_stale_cb_freplace.c


base-commit: 6c096bb08de97cdca051fecddad22cac6a1fd275
-- 
2.55.0