[PATCH net] xsk: set network header on skb at generic transmit

[PATCH net] xsk: set network header on skb at generic transmit

[Jason Xing]

When constructing an skb in the XSK generic transmit path, neither
xsk_build_skb() nor xsk_build_skb_zerocopy() calls
skb_reset_network_header(). After __finalize_skb_around(), the
network_header offset defaults to 0 (pointing to skb->head). The
subsequent skb_reserve(skb, hr) moves skb->data forward by hr bytes,
but leaves network_header still at 0. This makes skb_network_offset()
return a negative value (-hr).

When such an skb reaches a tunnel driver like ipgre_xmit(), the call
chain pskb_inet_may_pull() -> pskb_network_may_pull_reason() computes:

    pskb_may_pull_reason(skb, skb_network_offset(skb) + nhlen)

The negative int from skb_network_offset() is implicitly promoted to
unsigned int, wrapping around to a huge value. This triggers the
DEBUG_NET_WARN_ON_ONCE(len > INT_MAX) in pskb_may_pull_reason().

Call trace from syzkaller:
  ipgre_xmit+0x958/0xcd0 net/ipv4/ip_gre.c:658
  __netdev_start_xmit include/linux/netdevice.h:5400
  netdev_start_xmit include/linux/netdevice.h:5409
  __dev_direct_xmit+0x4b6/0x730 net/core/dev.c:4942
  __xsk_generic_xmit net/xdp/xsk.c:1079
  xsk_generic_xmit+0x277a/0x40a0 net/xdp/xsk.c:1120

Fix this by calling skb_reset_network_header() in the common path to
cover both the copy and the zerocopy cases, so that network_header
points at skb->data and skb_network_offset() returns 0.

Fixes: 3914d88f7608 ("xsk: Respect device's headroom and tailroom on generic xmit path")
Reported-by: syzbot+f16c1b285c9f63994eec@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f16c1b285c9f63994eec
Signed-off-by: Jason Xing <kerneljasonxing@gmail.com>
---
 net/xdp/xsk.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 33475b180ea6..2077bb6299ca 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -947,6 +947,8 @@ static int xsk_skb_init_misc(struct sk_buff *skb, struct xdp_sock *xs,
 {
 	int err;
 
+	skb_reset_network_header(skb);
+
 	err = xsk_skb_destructor_set_addr(skb, addr);
 	if (unlikely(err))
 		return err;
-- 
2.43.5

Re: [PATCH net] xsk: set network header on skb at generic transmit

[Jakub Kicinski]

On Wed, 26 Aug 2026 09:20:52 +0800 Jason Xing wrote:
> Fix this by calling skb_reset_network_header() in the common path to
> cover both the copy and the zerocopy cases, so that network_header
> points at skb->data and skb_network_offset() returns 0.

But you're setting it to start of the frame so most likely L2.
AF_PACKET seems to probe to find the true network header.
IDK. At the very least the commit message should be explaining
why the fix is right instead of the slop explaining the path
that triggers the crash.
-- 
pw-bot: cr

Re: [PATCH net] xsk: set network header on skb at generic transmit

[Jason Xing]

On Tue, Sep 1, 2026 at 8:02 AM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Wed, 26 Aug 2026 09:20:52 +0800 Jason Xing wrote:
> > Fix this by calling skb_reset_network_header() in the common path to
> > cover both the copy and the zerocopy cases, so that network_header
> > points at skb->data and skb_network_offset() returns 0.
>
> But you're setting it to start of the frame so most likely L2.
> AF_PACKET seems to probe to find the true network header.

They differ in this aspect. Because AF_XDP unlike AF_PACKET doesn't
take the responsibility to insert a L2 header for the data that
application tries to transfer.

Probably you refer to transport header (skb_probe_transport_header).

> IDK. At the very least the commit message should be explaining
> why the fix is right instead of the slop explaining the path
> that triggers the crash.

Thanks for the suggestion. I'm going to add the comparison and more
detailed sentences about this.

V2 is coming soon.

Thanks,
Jason

> --
> pw-bot: cr