Re: BUG: bpf: WARNING in skb_vlan_push from TC BPF action

[Jiayuan Chen]

On 8/12/26 12:36 PM, Kenneth Lee wrote:
> Hi,
>
> While fuzzing, the following warning has been found by a custom fuzzer
> developed by Sechang Lim <rhkrqnwk98@xxxxxxxxx>:
>
>    skb_vlan_push got skb with skb->data not at mac header (offset 14)


I think we didn't handle skb correctly when xdp prog is attached to L3 
device.

bpf_prog_run_generic_xdp:

    if ((orig_eth_type != eth->h_proto) ||
        (orig_host != ether_addr_equal_64bits(eth->h_dest,
                          skb->dev->dev_addr)) ||
        (orig_bcast != is_multicast_ether_addr_64bits(eth->h_dest))) {
        __skb_push(skb, ETH_HLEN); >>>>>>>> for L3 dev, mac_len is zero 
but now we have L2 area
        skb->pkt_type = PACKET_HOST;
        skb->protocol = eth_type_trans(skb, skb->dev); >>>>>>>> mac_len 
is still 0 but mac_header = data - 14
    }


TC:

__skb_push(skb, skb->mac_len)  >>> try to pointer data to mac header but 
it is pointless since mac_len is 0


int skb_vlan_push(struct sk_buff *skb, __be16 vlan_proto, u16 vlan_tci)
{
    if (skb_vlan_tag_present(skb)) {
            int offset = skb->data - skb_mac_header(skb); >>>>>>>> 
offset should be 0 because we want data pointer to mac_header is 14
            if (WARN_ONCE(offset, "...offset %d\n", offset))
                    return -EINVAL;
            ...
    }
    return 0;
}


> Unfortunately, we haven't found a reproducer for the warning yet. We'll
> inform you if we have any update on the warning.


Could you check whether the fuzzing log contains any XDP-related operations?