Re: BUG: bpf: WARNING in skb_vlan_push from TC BPF action

Hi Jiayuan,

> Could you check whether the fuzzing log contains any XDP-related operations?

Your analysis was correct. The fuzzing path did include XDP-related operations.
I've managed to create a C reproducer to run on v7.2-rc4-102-g4539944e5151.
The reproducer

- attaches generic XDP to the L3 device sit0
- calls bpf_xdp_adjust_head(-14) and changes the Ethernet destination
- uses bpf_clone_redirect(..., sit0, BPF_F_INGRESS)
- attaches a TC BPF action that calls bpf_skb_vlan_push().

The relevant state transition showed as:

  after redirect to sit0:  skb->mac_len = 0, skb_vlan_tag_present = 1
  after generic XDP:      skb->data - skb_mac_header(skb) = 14.
                          skb->mac_len = 0
  in the TC BPF action:   skb_vlan_push() reports offset 14

And thus the following warning appeared:

  skb_vlan_push got skb with skb->data not at mac header (offset 14)
  WARNING: net/core/skbuff.c:6477 at skb_vlan_push+0x51c/0x7c0

I've included a short log excerpt below.

Thanks,
Kenneth Lee
---
Reproducer output on Linux v7.2-rc4-102-g4539944e5151:

[vlan-c-repro] BPF_PROG_LOAD xdp adjust_head=-14 mutate_eth=1 fd=3 errno=0 (ok)
[vlan-c-repro] BPF_PROG_LOAD clone_redirect ifindex=5 flags=0x1 fd=5 errno=0 (ok)
[vlan-c-repro] attached; sending packets from veth0_tag

skb_vlan_push got skb with skb->data not at mac header (offset 14)
WARNING: net/core/skbuff.c:6477 at skb_vlan_push+0x51c/0x7c0

Call Trace:
  bpf_skb_vlan_push
  tcf_bpf_act
  tcf_action_exec
  cls_bpf_classify
  tcf_classify
  tc_run
  __netif_receive_skb_core

Debug lines from local kernel instrumentation:

__bpf_redirect_no_mac(): after skb_reset_mac_len():
  offset=0, mac_len=0, vlan tag present

__netif_receive_skb_core(): after do_xdp_generic():
  offset=14, mac_len=0, vlan tag present

tc_run(): before tcf_classify():
  offset=14, mac_len=0, vlan tag present

tcf_bpf_act(): before __skb_push(skb, skb->mac_len):
  offset=14, mac_len=0

bpf_skb_vlan_push(): before skb_vlan_push():
  offset=14, mac_len=0