From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta1.migadu.com (out-151.mta1.migadu.com [95.215.58.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4BDA73EFD30 for ; Wed, 12 Aug 2026 10:20:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.151 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786530026; cv=none; b=h4u66DCnwABRswRqpSnuwbQf4nu/iEn+y8vJ108G74C6MDsQ/S/kywU7LamDZLF9IomaR9BxVoH2aO3/pNnHvXdqhqFtvjfjO6MKVdDmLJdSI5T05lgk95+CC44XWf5s4n5Wp1VAINpwbMLzzI8xALWOXgN8UvKA5ryQit9fgzM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786530026; c=relaxed/simple; bh=AKKz4R62gWjxKFK3x26tK+HQQR/t32whLyvbOTQp0gc=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=En7rbl5he4ZOUtGnBC72ZB6FNt/b0G+aYcTZnOEKfOnZ8jYs/xqI141ZbEHZXc9ZJv9hEVlM/30ryklFTYUbJHFz8LTm8N9XPq4I09SiwHFUpW/dvJuG4DV0lX0Jpqz6L8axKOlFnE0rgR6iRBxH2hrYCgtKtWw/L6A+IbEnvo4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=MkxhGN0Q; arc=none smtp.client-ip=95.215.58.151 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="MkxhGN0Q" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=AKKz4R62gWjxKFK3x26tK+HQQR/t32whLyvbOTQp0gc=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1786530017; v=1; x=1787134817; b=MkxhGN0QzPgGHvHGigQAP4Nrrlp44NRjEoH/RqAc51n+jlnotQ6+2UPKB02QXUkcPR18FRl1 P5DyzS/e7jlnvSbnavrGVDFQ9uXOPFQBE4paVSjnywBoP8fmkm5hSlN94yhsazsn8zRcK6zPJmU R+12nCkIj6gipvdZuZ+Jd2Hs= X-Envelope-To: linux-kernel@vger.kernel.org Received: from [10.54.25.56] (222.72.143.228) by smtp.migadu.com with ESMTPS id 4e831d1d3b8922a3; Wed, 12 Aug 2026 10:20:17 +0000 X-Migadu-Scanner: mta11.migadu.com Authentication-Results: mta11.migadu.com; none Message-ID: <9e2313ac-ea90-4911-9fc3-9581ec44bafd@linux.dev> Date: Wed, 12 Aug 2026 18:20:01 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: BUG: bpf: WARNING in skb_vlan_push from TC BPF action To: Kenneth Lee , bpf@vger.kernel.org Cc: linux-kernel@vger.kernel.org, ast@kernel.org, andrii@kernel.org, daniel@iogearbox.net, eddyz87@gmail.com, jolsa@kernel.org, john.fastabend@gmail.com, memxor@gmail.com, martin.lau@linux.dev, song@kernel.org, sdf@fomichev.me, yonghong.song@linux.dev, rhkrqnwk98@gmail.com References: <20260812043643.808295-1-kennethbwlee@snu.ac.kr> From: Jiayuan Chen In-Reply-To: <20260812043643.808295-1-kennethbwlee@snu.ac.kr> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit On 8/12/26 12:36 PM, Kenneth Lee wrote: > Hi, > > While fuzzing, the following warning has been found by a custom fuzzer > developed by Sechang Lim : > > skb_vlan_push got skb with skb->data not at mac header (offset 14) I think we didn't handle skb correctly when xdp prog is attached to L3 device. bpf_prog_run_generic_xdp:     if ((orig_eth_type != eth->h_proto) ||         (orig_host != ether_addr_equal_64bits(eth->h_dest,                           skb->dev->dev_addr)) ||         (orig_bcast != is_multicast_ether_addr_64bits(eth->h_dest))) {         __skb_push(skb, ETH_HLEN); >>>>>>>> for L3 dev, mac_len is zero but now we have L2 area         skb->pkt_type = PACKET_HOST;         skb->protocol = eth_type_trans(skb, skb->dev); >>>>>>>> mac_len is still 0 but mac_header = data - 14     } TC: __skb_push(skb, skb->mac_len)  >>> try to pointer data to mac header but it is pointless since mac_len is 0 int skb_vlan_push(struct sk_buff *skb, __be16 vlan_proto, u16 vlan_tci) {     if (skb_vlan_tag_present(skb)) {             int offset = skb->data - skb_mac_header(skb); >>>>>>>> offset should be 0 because we want data pointer to mac_header is 14             if (WARN_ONCE(offset, "...offset %d\n", offset))                     return -EINVAL;             ...     }     return 0; } > Unfortunately, we haven't found a reproducer for the warning yet. We'll > inform you if we have any update on the warning. Could you check whether the fuzzing log contains any XDP-related operations?