[PATCH net-next] net: no longer reset transport_header in __netif_receive_skb_core()

[PATCH net-next] net: no longer reset transport_header in __netif_receive_skb_core()

[Eric Dumazet]

In commit 66e4c8d95008 ("net: warn if transport header was not set")
I added a debug check in skb_transport_header() to detect
if a caller expects the transport_header to be set to a meaningful
value by a prior code path.

Unfortunately, __netif_receive_skb_core() resets the transport header
to the same value than the network header, defeating this check
in receive paths.

Pretending the transport and network headers are the same
is usually wrong.

This patch removes this reset for CONFIG_DEBUG_NET=y builds
to let fuzzers and CI find bugs.

Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/core/dev.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index 073f682a9653a212198b12bae17fafe7b46f96e9..d2b6b3b96459159dc6fbd34143821516e9d0c5bd 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5476,8 +5476,14 @@ static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
 	orig_dev = skb->dev;
 
 	skb_reset_network_header(skb);
+#if !defined(CONFIG_DEBUG_NET)
+	/* We plan to no longer reset the transport header here.
+	 * Give some time to fuzzers and dev build to catch bugs
+	 * in network stacks.
+	 */
 	if (!skb_transport_header_was_set(skb))
 		skb_reset_transport_header(skb);
+#endif
 	skb_reset_mac_len(skb);
 
 	pt_prev = NULL;
-- 
2.47.1.613.gc27f4b7a9f-goog

Re: [PATCH net-next] net: no longer reset transport_header in __netif_receive_skb_core()

[Simon Horman]

On Tue, Jan 07, 2025 at 02:43:42PM +0000, Eric Dumazet wrote:
> In commit 66e4c8d95008 ("net: warn if transport header was not set")
> I added a debug check in skb_transport_header() to detect
> if a caller expects the transport_header to be set to a meaningful
> value by a prior code path.
> 
> Unfortunately, __netif_receive_skb_core() resets the transport header
> to the same value than the network header, defeating this check
> in receive paths.
> 
> Pretending the transport and network headers are the same
> is usually wrong.
> 
> This patch removes this reset for CONFIG_DEBUG_NET=y builds
> to let fuzzers and CI find bugs.
> 
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net-next] net: no longer reset transport_header in __netif_receive_skb_core()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Tue,  7 Jan 2025 14:43:42 +0000 you wrote:
> In commit 66e4c8d95008 ("net: warn if transport header was not set")
> I added a debug check in skb_transport_header() to detect
> if a caller expects the transport_header to be set to a meaningful
> value by a prior code path.
> 
> Unfortunately, __netif_receive_skb_core() resets the transport header
> to the same value than the network header, defeating this check
> in receive paths.
> 
> [...]

Here is the summary with links:
  - [net-next] net: no longer reset transport_header in __netif_receive_skb_core()
    https://git.kernel.org/netdev/net-next/c/2170a1f09148

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html