Re: [PATCH] bpf: reject unset network_header for SKF_NET_OFF in cBPF load helper

[Alexei Starovoitov]

On Sat, Sep 19, 2026 at 08:35 PM Hui Peng <benquike@xxxxxxxxx> wrote:
> diff --git a/net/core/filter.c b/net/core/filter.c
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -231,8 +231,14 @@ static int bpf_skb_load_helper_convert_offset(const struct sk_buff *skb, int off
>  	if (likely(offset >= 0))
>  		return offset;
>
> -	if (offset >= SKF_NET_OFF)
> +	if (offset >= SKF_NET_OFF) {
> +		if (skb_mac_header_was_set(skb) ?
> +		    skb->network_header < skb->mac_header :
> +		    (skb_network_offset(skb) < 0 ||
> +		     (!skb->protocol && !skb->network_header)))
> +			return INT_MIN;

No. network_header == 0 is a valid value when there is no headroom and
skb->protocol says nothing about it.

When netlink_dump() had this problem it was fixed by
skb_reset_network_header() after skb_reserve(). See
commit 99c07327ae11 ("netlink: reset network and mac headers in netlink_dump()").

pw-bot: cr