From: Jiayuan Chen <jiayuan.chen@linux.dev>
To: Kenneth Lee <kennethbwlee@snu.ac.kr>, bpf@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, ast@kernel.org, andrii@kernel.org,
daniel@iogearbox.net, eddyz87@gmail.com, jolsa@kernel.org,
john.fastabend@gmail.com, memxor@gmail.com, martin.lau@linux.dev,
song@kernel.org, sdf@fomichev.me, yonghong.song@linux.dev,
rhkrqnwk98@gmail.com
Subject: Re: BUG: bpf: WARNING in skb_vlan_push from TC BPF action
Date: Wed, 12 Aug 2026 18:20:01 +0800 [thread overview]
Message-ID: <9e2313ac-ea90-4911-9fc3-9581ec44bafd@linux.dev> (raw)
In-Reply-To: <20260812043643.808295-1-kennethbwlee@snu.ac.kr>
On 8/12/26 12:36 PM, Kenneth Lee wrote:
> Hi,
>
> While fuzzing, the following warning has been found by a custom fuzzer
> developed by Sechang Lim <rhkrqnwk98@gmail.com>:
>
> skb_vlan_push got skb with skb->data not at mac header (offset 14)
I think we didn't handle skb correctly when xdp prog is attached to L3
device.
bpf_prog_run_generic_xdp:
if ((orig_eth_type != eth->h_proto) ||
(orig_host != ether_addr_equal_64bits(eth->h_dest,
skb->dev->dev_addr)) ||
(orig_bcast != is_multicast_ether_addr_64bits(eth->h_dest))) {
__skb_push(skb, ETH_HLEN); >>>>>>>> for L3 dev, mac_len is zero
but now we have L2 area
skb->pkt_type = PACKET_HOST;
skb->protocol = eth_type_trans(skb, skb->dev); >>>>>>>> mac_len
is still 0 but mac_header = data - 14
}
TC:
__skb_push(skb, skb->mac_len) >>> try to pointer data to mac header but
it is pointless since mac_len is 0
int skb_vlan_push(struct sk_buff *skb, __be16 vlan_proto, u16 vlan_tci)
{
if (skb_vlan_tag_present(skb)) {
int offset = skb->data - skb_mac_header(skb); >>>>>>>>
offset should be 0 because we want data pointer to mac_header is 14
if (WARN_ONCE(offset, "...offset %d\n", offset))
return -EINVAL;
...
}
return 0;
}
> Unfortunately, we haven't found a reproducer for the warning yet. We'll
> inform you if we have any update on the warning.
Could you check whether the fuzzing log contains any XDP-related operations?
prev parent reply other threads:[~2026-08-12 10:20 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-12 4:36 BUG: bpf: WARNING in skb_vlan_push from TC BPF action Kenneth Lee
2026-08-12 10:20 ` Jiayuan Chen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9e2313ac-ea90-4911-9fc3-9581ec44bafd@linux.dev \
--to=jiayuan.chen@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kennethbwlee@snu.ac.kr \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=rhkrqnwk98@gmail.com \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.