Re: bpf: missing transport_header validation in bpf_prog_test_run_skb triggers WARNING

[Martin KaFai Lau <martin.lau@linux.dev>]

On 11/3/25 1:42 AM, 梅开彦 wrote:
> Our fuzzer tool discovered a missing check for `transport_header` field initialization
> in the `bpf_prog_test_run_skb` function within the Linux kernel's BPF subsystem. This
> vulnerability will lead to a WARNING issue.
> 
> Reported-by: Kaiyan Mei <M202472210@hust.edu.cn>
> Reported-by: Yinhao Hu <dddddd@hust.edu.cn>
> Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
> 
> ## Root Cause
> 
> In the `bpf_prog_test_run_skb` funtion, the `skb` created for BPF program execution
> may have uninitialized `transport_header` (remaining as the magic value ~0U).
> When the BPF program calls `bpf_skb_check_mtu` helper, it eventually reaches
> `skb_gso_validate_network_len()` which assumes `skb->transport_header` is properly
> set. The access to uninitialized transport header through `skb_transport_header()`
> triggers the WARNING.
> 
> ## Reproduction Steps
> 
> 1. **BPF Program**: Load a simple BPF program that calls `bpf_check_mtu`
>     
> 2. **Context**: Create `__sk_buff` with following fields:
>      - `skb->gso_size = 0x1`
>      - `skb->ifindex = 0x0e`
>      This would ensure the `skb_gso_validate_network_len()` funtion could be reached
> within the `bpf_skb_check_mtu` helper.
> 
> 3. **Trigger**: Execute the program via `BPF_PROG_TEST_RUN`
>     The kernel detects the uninitialized `transport_header` field in `skb_transport_header` and
> triggers WARNING.
>      
> 
> ## KASAN Report
> 
> ```
> WARNING: CPU: 0 PID: 9932 at ./include/linux/skbuff.h:3071 skb_transport_header include/linux/skbuff.h:3071 [inline]

I think it needs a skb_reset_transport_header in bpf_prog_test_run_skb().