Re: [PATCH net v2] seg6: Fix unset mac header in SRv6 End.DT VRF decapsulation

[Andrea Mayer]

On Sat, 17 Oct 2026 20:01:44 +0800
Boyan Liu <yymhvert@xxxxxxxxx> wrote:

> SRv6 End.DT4/End.DT6 VRF decapsulation unsets the mac header in
> end_dt_vrf_rcv() so that the VRF device can rebuild it for packet
> sniffers. The VRF rx handler only performs the rebuild when a
> sniffer is actually attached to the VRF device (ptype_all
> non-empty); otherwise the packet continues up the stack with
> mac_header == 0xffff.
>
> Every other receive path delivers packets with a valid mac header:
> NIC drivers set it in eth_type_trans(), and tunnels without an L2
> header (ipip, sit, gre, tun) reset it to the network header after
> decapsulation. skb_mac_header() even warns on the unset state with
> DEBUG_NET_WARN_ON_ONCE().
>
> If the decapsulated packet is an unexpected UDP GSO packet,
> udp_queue_rcv_skb() re-segments it after restoring skb->data to the
> mac header with __skb_push(skb, -skb_mac_offset(skb)). With the mac
> header unset, skb_mac_offset() returns a large positive value,
> which the unsigned __skb_push() argument turns into a huge length:
> skb->data moves far outside the buffer and skb->len is corrupted,
> so segmentation reads out of bounds:
>
>     BUG: KASAN: slab-out-of-bounds in inet_gso_segment (net/ipv4/af_inet.c:1383)
>     Read of size 1 at addr ffff88800da7ffff by task exploit/149
>     Call Trace:
>      inet_gso_segment (net/ipv4/af_inet.c:1383)
>      skb_mac_gso_segment (net/core/gso.c:53)
>      __skb_gso_segment (net/core/gso.c:124)
>      udp_queue_rcv_skb (net/ipv4/udp.c:2476 net/ipv4/udp.c:2466)
>      udp_unicast_rcv_skb (net/ipv4/udp.c:2620)
>      ip_local_deliver (net/ipv4/ip_input.c:262)
>      seg6_local_input_core (net/ipv6/seg6_local.c:1640)
>      lwtunnel_input (net/core/lwtunnel.c:465)
>      ipv6_rcv (net/ipv6/ip6_input.c:351)
>
> Restore a valid mac header, pointing at the network header, once
> the VRF rx handler returns. The sniffer rebuild happens inside the
> handler while the header is still unset, so tap behavior is
> unchanged; when no rebuild happened, the packet now carries the
> same mac header state as any packet received on an L3 device.

Thanks Boyan. On the SRv6 side the approach looks reasonable to me.
With my own reproducer I see a KASAN slab-out-of-bounds in
inet_gso_segment() without the fix. With the fix I could not reproduce it
anymore, and the datagrams are delivered. A sniffer on the VRF sees the
same L2 header with and without the fix.

> [snip]
> diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c
> index 7b5212220185..5232c9e2b7d7 100644
> --- a/net/ipv6/seg6_local.c
> +++ b/net/ipv6/seg6_local.c
> @@ -1113,6 +1113,14 @@ static struct sk_buff *end_dt_vrf_rcv(struct sk_buff *skb, u16 family,
>  		/* the skb buffer was consumed by the handler */
>  		return NULL;
>  
> +	/* the VRF device had its chance to rebuild the mac header for
> +	 * sniffers; restore a valid one pointing at the network header,
> +	 * like any L3 device without an L2 header, before the packet
> +	 * continues up the stack.
> +	 */
> +	if (!skb_mac_header_was_set(skb))
> +		skb_reset_mac_header(skb);
> +
>  	/* when a packet is received by a VRF or by one of its slaves, the
>  	 * master device reference is set into the skb.
>  	 */

The patch sets the mac header but not skb->mac_len, which stays at the
value the ingress left (e.g. 14). IMO the patch should also reset
skb->mac_len with skb_reset_mac_len(), which gives 0 with the mac header at
the network header. Sashiko raised the same point.

Sashiko also asks about L2ENCAP. With the fix, the decapsulated packets now
pass the skb_mac_header_was_set() check in seg6_do_srh() when the VRF has
no sniffer. In my tests L2ENCAP then builds a malformed frame.
skb_mac_header_was_set() only means the mac header is set, not that a real
L2 header is present, and the L2 ends up rebuilt from the IP header bytes.
Resetting mac_len does not make the frame valid either, since the IP header
itself then sits where the L2 header should be. skb_mac_header_was_set()
already lets End.DX4 packets into L2ENCAP without the fix, and the
resulting frame is malformed as well. I will look at the L2ENCAP check
separately.

Ciao,
Andrea