__alloc_skb() sets skb->mac_header to (typeof(skb->mac_header))~0U via
__finalize_skb_around(). skb_reset_mac_len() checks if the value has been
updated via the skb_mac_header_was_set() and fires
DEBUG_NET_WARN_ON_ONCE(1) if not.

init_can_skb() previously included three header reset calls:

- skb_reset_mac_header(skb)
- skb_reset_network_header(skb)
- skb_reset_transport_header(skb)

Commit 9f10374bb024 ("can: remove private CAN skb headroom
infrastructure") dropped these calls which leads to the skb->mac_header
retaining the original value.

Restore the three missing calls in the init_can_skb().

Fixes: 9f10374bb024 ("can: remove private CAN skb headroom infrastructure")
Reported-by: syzbot+1aae11dc8d42ec1a87ec@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1aae11dc8d42ec1a87ec
Signed-off-by: Shaunak Datar <shaunakkdatar@gmail.com>
---
 drivers/net/can/dev/skb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/can/dev/skb.c b/drivers/net/can/dev/skb.c
index 95fcdc1026f8..9cbddc1edd41 100644
--- a/drivers/net/can/dev/skb.c
+++ b/drivers/net/can/dev/skb.c
@@ -210,6 +210,9 @@ static void init_can_skb(struct sk_buff *skb)
 {
 	skb->pkt_type = PACKET_BROADCAST;
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
+	skb_reset_mac_header(skb);
+	skb_reset_network_header(skb);
+	skb_reset_transport_header(skb);
 }
 
 struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
-- 
2.53.0

Hallo Shaunak,

many thanks for your patch. But there's already a fix awaiting upstream:

https://lore.kernel.org/linux-can/20260917123716.63116-1-ndaugoing@gmail.com/

Best regards,
Oliver

On 18.09.26 17:16, Shaunak Datar wrote:
> __alloc_skb() sets skb->mac_header to (typeof(skb->mac_header))~0U via
> __finalize_skb_around(). skb_reset_mac_len() checks if the value has been
> updated via the skb_mac_header_was_set() and fires
> DEBUG_NET_WARN_ON_ONCE(1) if not.
> 
> init_can_skb() previously included three header reset calls:
> 
> - skb_reset_mac_header(skb)
> - skb_reset_network_header(skb)
> - skb_reset_transport_header(skb)
> 
> Commit 9f10374bb024 ("can: remove private CAN skb headroom
> infrastructure") dropped these calls which leads to the skb->mac_header
> retaining the original value.
> 
> Restore the three missing calls in the init_can_skb().
> 
> Fixes: 9f10374bb024 ("can: remove private CAN skb headroom infrastructure")
> Reported-by: syzbot+1aae11dc8d42ec1a87ec@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=1aae11dc8d42ec1a87ec
> Signed-off-by: Shaunak Datar <shaunakkdatar@gmail.com>
> ---
>   drivers/net/can/dev/skb.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/can/dev/skb.c b/drivers/net/can/dev/skb.c
> index 95fcdc1026f8..9cbddc1edd41 100644
> --- a/drivers/net/can/dev/skb.c
> +++ b/drivers/net/can/dev/skb.c
> @@ -210,6 +210,9 @@ static void init_can_skb(struct sk_buff *skb)
>   {
>   	skb->pkt_type = PACKET_BROADCAST;
>   	skb->ip_summed = CHECKSUM_UNNECESSARY;
> +	skb_reset_mac_header(skb);
> +	skb_reset_network_header(skb);
> +	skb_reset_transport_header(skb);
>   }
>   
>   struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)