* Re: [PATCH net] net: icmp: avoid invalid transport header access in icmp_send tracepoint
2026-08-25 8:45 [PATCH net] net: icmp: avoid invalid transport header access in icmp_send tracepoint Eric Dumazet
@ 2026-08-25 9:43 ` Jiayuan Chen
2026-08-25 12:50 ` Steven Rostedt
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Jiayuan Chen @ 2026-08-25 9:43 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Ido Schimmel, David Ahern, netdev, eric.dumazet,
syzbot+6d2762674103618994b0, Peilin He, xu xin, Steven Rostedt
On 8/25/26 4:45 PM, Eric Dumazet wrote:
> syzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_ONCE():
>
> WARNING: at skb_transport_header include/linux/skbuff.h:3087 [inline]
> WARNING: at udp_hdr include/linux/udp.h:23 [inline]
> WARNING: at do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline]
> WARNING: at trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11
> Call trace:
> skb_transport_header include/linux/skbuff.h:3087 [inline]
> udp_hdr include/linux/udp.h:23 [inline]
> do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline]
> trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11
> __traceiter_icmp_send include/trace/events/icmp.h:11 [inline]
> __do_trace_icmp_send include/trace/events/icmp.h:11 [inline]
> trace_icmp_send+0x320/0x49c include/trace/events/icmp.h:11
> __icmp_send+0xcfc/0x11d8 net/ipv4/icmp.c:1013
> ipv4_send_dest_unreach net/ipv4/route.c:1280 [inline]
> ipv4_link_failure+0x57c/0x8dc net/ipv4/route.c:1287
> dst_link_failure include/net/dst.h:438 [inline]
> vti_tunnel_xmit+0xe40/0x17a4 net/ipv4/ip_vti.c:307
>
> TP_fast_assign() unconditionally calls udp_hdr(skb) before checking
> whether the packet is UDP. Furthermore, __icmp_send() can be invoked
> from paths (e.g., link failures, ARP errors, forwarding, AF_PACKET)
> where skb->transport_header was never initialized (~0U).
>
> Under CONFIG_DEBUG_NET=y, calling skb_transport_header(skb) triggers
> DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)).
>
> Fix this by:
> 1. Only parsing transport info when iph->protocol == IPPROTO_UDP.
> 2. Using skb_header_pointer() at skb_network_offset(skb) + (iph->ihl << 2)
> to safely fetch the UDP header without assuming transport_header is set.
>
> Fixes: db3efdcf70c7 ("net/ipv4: add tracepoint for icmp_send")
> Reported-by: syzbot+6d2762674103618994b0@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a8d5538.91706f20.ef82.0009.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Peilin He <he.peilin@zte.com.cn>
> Cc: xu xin <xu.xin16@zte.com.cn>
> Cc: Steven Rostedt <rostedt@goodmis.org>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
> include/trace/events/icmp.h | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/include/trace/events/icmp.h b/include/trace/events/icmp.h
> index 09ae115099dfe25616b6c74d5b92be1af4acff55..6937b778ae54dbf4442b127957a017da3551aaff 100644
> --- a/include/trace/events/icmp.h
> +++ b/include/trace/events/icmp.h
> @@ -27,17 +27,20 @@ TRACE_EVENT(icmp_send,
>
> TP_fast_assign(
> struct iphdr *iph = ip_hdr(skb);
> - struct udphdr *uh = udp_hdr(skb);
> - int proto_4 = iph->protocol;
> + struct udphdr _uh, *uh = NULL;
> __be32 *p32;
>
> __entry->skbaddr = skb;
> __entry->type = type;
> __entry->code = code;
>
> - if (proto_4 != IPPROTO_UDP || (u8 *)uh < skb->head ||
> - (u8 *)uh + sizeof(struct udphdr)
> - > skb_tail_pointer(skb)) {
> + if (iph->protocol == IPPROTO_UDP)
> + uh = skb_header_pointer(skb,
> + skb_network_offset(skb) +
> + (iph->ihl << 2),
> + sizeof(_uh), &_uh);
> +
> + if (!uh) {
> __entry->sport = 0;
> __entry->dport = 0;
> __entry->ulen = 0;
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH net] net: icmp: avoid invalid transport header access in icmp_send tracepoint
2026-08-25 8:45 [PATCH net] net: icmp: avoid invalid transport header access in icmp_send tracepoint Eric Dumazet
2026-08-25 9:43 ` Jiayuan Chen
@ 2026-08-25 12:50 ` Steven Rostedt
2026-08-25 14:11 ` Eric Dumazet
2026-08-25 14:48 ` David Ahern
2026-08-28 22:10 ` patchwork-bot+netdevbpf
3 siblings, 1 reply; 6+ messages in thread
From: Steven Rostedt @ 2026-08-25 12:50 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Simon Horman,
Ido Schimmel, David Ahern, netdev, eric.dumazet,
syzbot+6d2762674103618994b0, Peilin He, xu xin
On Tue, 25 Aug 2026 08:45:51 +0000
Eric Dumazet <edumazet@google.com> wrote:
> diff --git a/include/trace/events/icmp.h b/include/trace/events/icmp.h
> index 09ae115099dfe25616b6c74d5b92be1af4acff55..6937b778ae54dbf4442b127957a017da3551aaff 100644
> --- a/include/trace/events/icmp.h
> +++ b/include/trace/events/icmp.h
> @@ -27,17 +27,20 @@ TRACE_EVENT(icmp_send,
>
> TP_fast_assign(
> struct iphdr *iph = ip_hdr(skb);
> - struct udphdr *uh = udp_hdr(skb);
> - int proto_4 = iph->protocol;
> + struct udphdr _uh, *uh = NULL;
> __be32 *p32;
>
> __entry->skbaddr = skb;
> __entry->type = type;
> __entry->code = code;
>
> - if (proto_4 != IPPROTO_UDP || (u8 *)uh < skb->head ||
> - (u8 *)uh + sizeof(struct udphdr)
> - > skb_tail_pointer(skb)) {
> + if (iph->protocol == IPPROTO_UDP)
> + uh = skb_header_pointer(skb,
> + skb_network_offset(skb) +
> + (iph->ihl << 2),
> + sizeof(_uh), &_uh);
I don't know if networking has different rules about this, but we usually
suggest using brackets around the if block for any multi line code. Not
just multi commands. If the line needs to be broken due to length, we
suggest brackets.
-- Steve
> +
> + if (!uh) {
> __entry->sport = 0;
> __entry->dport = 0;
> __entry->ulen = 0;
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH net] net: icmp: avoid invalid transport header access in icmp_send tracepoint
2026-08-25 12:50 ` Steven Rostedt
@ 2026-08-25 14:11 ` Eric Dumazet
0 siblings, 0 replies; 6+ messages in thread
From: Eric Dumazet @ 2026-08-25 14:11 UTC (permalink / raw)
To: Steven Rostedt
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Simon Horman,
Ido Schimmel, David Ahern, netdev, eric.dumazet,
syzbot+6d2762674103618994b0, Peilin He, xu xin
On Tue, Aug 25, 2026 at 2:50 PM Steven Rostedt <rostedt@goodmis.org> wrote:
>
> On Tue, 25 Aug 2026 08:45:51 +0000
> Eric Dumazet <edumazet@google.com> wrote:
>
> > diff --git a/include/trace/events/icmp.h b/include/trace/events/icmp.h
> > index 09ae115099dfe25616b6c74d5b92be1af4acff55..6937b778ae54dbf4442b127957a017da3551aaff 100644
> > --- a/include/trace/events/icmp.h
> > +++ b/include/trace/events/icmp.h
> > @@ -27,17 +27,20 @@ TRACE_EVENT(icmp_send,
> >
> > TP_fast_assign(
> > struct iphdr *iph = ip_hdr(skb);
> > - struct udphdr *uh = udp_hdr(skb);
> > - int proto_4 = iph->protocol;
> > + struct udphdr _uh, *uh = NULL;
> > __be32 *p32;
> >
> > __entry->skbaddr = skb;
> > __entry->type = type;
> > __entry->code = code;
> >
> > - if (proto_4 != IPPROTO_UDP || (u8 *)uh < skb->head ||
> > - (u8 *)uh + sizeof(struct udphdr)
> > - > skb_tail_pointer(skb)) {
> > + if (iph->protocol == IPPROTO_UDP)
> > + uh = skb_header_pointer(skb,
> > + skb_network_offset(skb) +
> > + (iph->ihl << 2),
> > + sizeof(_uh), &_uh);
>
> I don't know if networking has different rules about this, but we usually
> suggest using brackets around the if block for any multi line code. Not
> just multi commands. If the line needs to be broken due to length, we
> suggest brackets.
We do not have such rules in networking, and checkpatch is ok
(although I never use it)
scripts/checkpatch.pl -g HEAD
total: 0 errors, 0 warnings, 25 lines checked
Commit 27ce2cf2018e ("net: icmp: avoid invalid transport header access
in icmp_send tracepoint") has no obvious style problems and is ready
for submission.
Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net] net: icmp: avoid invalid transport header access in icmp_send tracepoint
2026-08-25 8:45 [PATCH net] net: icmp: avoid invalid transport header access in icmp_send tracepoint Eric Dumazet
2026-08-25 9:43 ` Jiayuan Chen
2026-08-25 12:50 ` Steven Rostedt
@ 2026-08-25 14:48 ` David Ahern
2026-08-28 22:10 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 6+ messages in thread
From: David Ahern @ 2026-08-25 14:48 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Ido Schimmel, netdev, eric.dumazet,
syzbot+6d2762674103618994b0, Peilin He, xu xin, Steven Rostedt
On 8/25/26 2:45 AM, Eric Dumazet wrote:
> syzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_ONCE():
>
> WARNING: at skb_transport_header include/linux/skbuff.h:3087 [inline]
> WARNING: at udp_hdr include/linux/udp.h:23 [inline]
> WARNING: at do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline]
> WARNING: at trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11
> Call trace:
> skb_transport_header include/linux/skbuff.h:3087 [inline]
> udp_hdr include/linux/udp.h:23 [inline]
> do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline]
> trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11
> __traceiter_icmp_send include/trace/events/icmp.h:11 [inline]
> __do_trace_icmp_send include/trace/events/icmp.h:11 [inline]
> trace_icmp_send+0x320/0x49c include/trace/events/icmp.h:11
> __icmp_send+0xcfc/0x11d8 net/ipv4/icmp.c:1013
> ipv4_send_dest_unreach net/ipv4/route.c:1280 [inline]
> ipv4_link_failure+0x57c/0x8dc net/ipv4/route.c:1287
> dst_link_failure include/net/dst.h:438 [inline]
> vti_tunnel_xmit+0xe40/0x17a4 net/ipv4/ip_vti.c:307
>
> TP_fast_assign() unconditionally calls udp_hdr(skb) before checking
> whether the packet is UDP. Furthermore, __icmp_send() can be invoked
> from paths (e.g., link failures, ARP errors, forwarding, AF_PACKET)
> where skb->transport_header was never initialized (~0U).
>
> Under CONFIG_DEBUG_NET=y, calling skb_transport_header(skb) triggers
> DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)).
>
> Fix this by:
> 1. Only parsing transport info when iph->protocol == IPPROTO_UDP.
> 2. Using skb_header_pointer() at skb_network_offset(skb) + (iph->ihl << 2)
> to safely fetch the UDP header without assuming transport_header is set.
>
> Fixes: db3efdcf70c7 ("net/ipv4: add tracepoint for icmp_send")
> Reported-by: syzbot+6d2762674103618994b0@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a8d5538.91706f20.ef82.0009.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Peilin He <he.peilin@zte.com.cn>
> Cc: xu xin <xu.xin16@zte.com.cn>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> ---
> include/trace/events/icmp.h | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/include/trace/events/icmp.h b/include/trace/events/icmp.h
> index 09ae115099dfe25616b6c74d5b92be1af4acff55..6937b778ae54dbf4442b127957a017da3551aaff 100644
> --- a/include/trace/events/icmp.h
> +++ b/include/trace/events/icmp.h
> @@ -27,17 +27,20 @@ TRACE_EVENT(icmp_send,
>
> TP_fast_assign(
> struct iphdr *iph = ip_hdr(skb);
> - struct udphdr *uh = udp_hdr(skb);
> - int proto_4 = iph->protocol;
> + struct udphdr _uh, *uh = NULL;
> __be32 *p32;
>
> __entry->skbaddr = skb;
> __entry->type = type;
> __entry->code = code;
>
> - if (proto_4 != IPPROTO_UDP || (u8 *)uh < skb->head ||
> - (u8 *)uh + sizeof(struct udphdr)
> - > skb_tail_pointer(skb)) {
> + if (iph->protocol == IPPROTO_UDP)
> + uh = skb_header_pointer(skb,
> + skb_network_offset(skb) +
> + (iph->ihl << 2),
> + sizeof(_uh), &_uh);
> +
> + if (!uh) {
> __entry->sport = 0;
> __entry->dport = 0;
> __entry->ulen = 0;
This code change looks fine, so:
Reviewed-by: David Ahern <dsahern@kernel.org>
But really, why not drop the tracepoint entirely and have the author of
the original patch send a new version that acknowledges icmp's are sent
for other transport protocols?
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH net] net: icmp: avoid invalid transport header access in icmp_send tracepoint
2026-08-25 8:45 [PATCH net] net: icmp: avoid invalid transport header access in icmp_send tracepoint Eric Dumazet
` (2 preceding siblings ...)
2026-08-25 14:48 ` David Ahern
@ 2026-08-28 22:10 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-08-28 22:10 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, horms, idosch, dsahern, netdev, eric.dumazet,
syzbot+6d2762674103618994b0, he.peilin, xu.xin16, rostedt
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 25 Aug 2026 08:45:51 +0000 you wrote:
> syzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_ONCE():
>
> WARNING: at skb_transport_header include/linux/skbuff.h:3087 [inline]
> WARNING: at udp_hdr include/linux/udp.h:23 [inline]
> WARNING: at do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline]
> WARNING: at trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11
> Call trace:
> skb_transport_header include/linux/skbuff.h:3087 [inline]
> udp_hdr include/linux/udp.h:23 [inline]
> do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline]
> trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11
> __traceiter_icmp_send include/trace/events/icmp.h:11 [inline]
> __do_trace_icmp_send include/trace/events/icmp.h:11 [inline]
> trace_icmp_send+0x320/0x49c include/trace/events/icmp.h:11
> __icmp_send+0xcfc/0x11d8 net/ipv4/icmp.c:1013
> ipv4_send_dest_unreach net/ipv4/route.c:1280 [inline]
> ipv4_link_failure+0x57c/0x8dc net/ipv4/route.c:1287
> dst_link_failure include/net/dst.h:438 [inline]
> vti_tunnel_xmit+0xe40/0x17a4 net/ipv4/ip_vti.c:307
>
> [...]
Here is the summary with links:
- [net] net: icmp: avoid invalid transport header access in icmp_send tracepoint
https://git.kernel.org/netdev/net/c/7fcc2fe39fed
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 6+ messages in thread