Re: [PATCH net v2] net: Clear skb metadata in LWT BPF xmit

[Chris Arges <carges@cloudflare.com>]

On 2026-05-14 12:47:09, Jakub Sitnicki wrote:
> skb metadata is meant for passing information between XDP and TC.
> LWT programs cannot access the __sk_buff->data_meta pseudo-pointer.
> 
> However, LWT_XMIT programs can call helpers that move packet data.
> One such helper is bpf_skb_change_head(), which uses skb_data_move() to
> move both packet data and metadata after skb_push(). skb_data_move()
> expects metadata to sit immediately before skb->data. This is the layout
> that commit 8989d328dfe7 ("net: Helper to move packet data and metadata
> after skb_push/pull") preserves for TC(X) programs when skb_push() or
> skb_pull() moves packet data.
> 
> The IP output path can run LWT xmit before neighbour output has built the
> outgoing L2 header. For forwarded, or otherwise RX-originated, packets
> skb->data points at the network header while skb_mac_header() can still
> point at the old L2 header. If such an skb still carries XDP metadata,
> skb_data_move() sees metadata ending at skb_mac_header(), not immediately
> before skb->data, and warns:
> 
>   WARNING: CPU: 21 PID: 454557 at include/linux/skbuff.h:4609 skb_data_move+0x47/0x90
>   CPU: 21 UID: 0 PID: 454557 Comm: napi/iconduit-g Tainted: G           O        6.18.21 #1
>   RIP: 0010:skb_data_move+0x47/0x90
>   Call Trace:
>    <IRQ>
>    bpf_skb_change_head+0xe6/0x1a0
>    bpf_prog_...+0x213/0x2e3
>    run_lwt_bpf.isra.0+0x1d3/0x360
>    bpf_xmit+0x46/0xe0
>    lwtunnel_xmit+0xa1/0xf0
>    ip_finish_output2+0x1e7/0x5e0
>    ip_output+0x63/0x100
>    __netif_receive_skb_one_core+0x85/0xa0
>    process_backlog+0x9c/0x150
>    __napi_poll+0x2b/0x190
>    net_rx_action+0x40b/0x7f0
>    handle_softirqs+0xd2/0x270
>    do_softirq+0x3f/0x60
>    </IRQ>
> 
> Drop skb metadata in the LWT BPF xmit path, just before invoking the
> program. Doing it late, rather than in ip[6]_finish_output2(), preserves
> metadata for tc egress on the outgoing device when no LWT BPF program is
> attached - the only scenario where carrying tc-layer metadata through the
> IP output path could be meaningful. Non-BPF LWT encap types do not run
> helpers that touch metadata, so the BPF xmit op is the only site that needs
> the clear.
> 
> Fixes: 8989d328dfe7 ("net: Helper to move packet data and metadata after skb_push/pull")
> Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
> ---
> Changes in v2:
> - Clear metadata in bpf_xmit to allow access from tc(x) egress (Daniel)
> - Add WARNING snippet to the description
> - Link to v1: https://lore.kernel.org/r/20260428-wip-skb-local-storage-from-scratch-v1-1-8f7ca9b378ce@cloudflare.com

I was able to reproduce the problem with a C program. After applying your patch
I could no longer repro.

Tested-by: Chris J Arges <carges@cloudflare.com>