netdev - Re: [PATCH RFC bpf-next 15/15] bpf: Realign skb metadata for TC progs using data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <4d340abe294ac0290710c745f5f48bfb89b12ed3ac2be1c2df6d85848b45724f@mail.kernel.org>
Date: Mon, 24 Nov 2025 16:58:04 +0000 (UTC)
From: bot+bpf-ci@...nel.org
To: jakub@...udflare.com,bpf@...r.kernel.org
Cc: netdev@...r.kernel.org,kernel-team@...udflare.com,martin.lau@...ux.dev,ast@...nel.org,andrii@...nel.org,daniel@...earbox.net,martin.lau@...nel.org,eddyz87@...il.com,yonghong.song@...ux.dev,clm@...a.com,ihor.solodrai@...ux.dev
Subject: Re: [PATCH RFC bpf-next 15/15] bpf: Realign skb metadata for TC progs using data_meta


commit 9078292074a586fc1414d4e4f5a2ad2d04a9e39c
Author: Jakub Sitnicki <jakub@...udflare.com>

bpf: Realign skb metadata for TC progs using data_meta

This commit restores BPF data_meta functionality for TC programs after
the metadata location was decoupled from MAC header offset. It introduces
bpf_skb_meta_realign() to close gaps between metadata and skb->data.

> commit 9078292074a586fc1414d4e4f5a2ad2d04a9e39c
> Author: Jakub Sitnicki <jakub@...udflare.com>
> Date:   Mon Nov 24 17:28:51 2025 +0100
>
>     bpf: Realign skb metadata for TC progs using data_meta
>
>     After decoupling metadata location from MAC header offset, a gap can appear
>     between metadata and skb->data on L2 decapsulation (e.g., VLAN, GRE). This
>     breaks the BPF data_meta pointer which assumes metadata is directly before
>     skb->data.
>
>     Introduce bpf_skb_meta_realign() kfunc to close the gap by moving metadata
>     to immediately precede the MAC header. Inject a call to it in
>     tc_cls_act_prologue() when the verifier detects data_meta access
>     (PA_F_DATA_META_LOAD flag).
>
>     Update skb_data_move() to handle the gap case: on skb_push(), move metadata
>     to the top of the head buffer; on skb_pull() where metadata is already
>     detached, leave it in place.
>
>     This restores data_meta functionality for TC programs while keeping the
>     performance benefit of avoiding memmove on L2 decapsulation for programs
>     that don't use data_meta.
>
>     Signed-off-by: Jakub Sitnicki <jakub@...udflare.com>

This appears to fix the bug introduced by commit 016079023cef ("net:
Track skb metadata end separately from MAC offset"). Should this include
a Fixes: tag?

The earlier commit message explicitly noted: "Note that this breaks BPF
skb metadata access through skb->data_meta when there is a gap between
meta_end and skb->data. Following BPF verifier changes address this."

This commit is one of those follow-up changes that addresses the
breakage.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/19641863515