In bpf_skb_load_helper_convert_offset(), SKF_LL_OFF checks
skb_mac_header_was_set(skb), whereas SKF_NET_OFF unconditionally returns:

        offset - SKF_NET_OFF + skb_network_offset(skb);

Unlike skb->mac_header (which __alloc_skb() initializes to ~0U),
skb->network_header is zero-initialized to 0. On sockets that reserve
headroom via skb_reserve() without setting a network header (such as
AF_UNIX sockets), skb->network_header remains 0, so
skb_network_offset(skb) evaluates to (skb->head - skb->data) = -headroom.

When bpf_skb_load_helper_(8, 16, 32)() then checks:

        if (headlen - offset >= len)
                return *(u8 *)(data + offset);

a negative converted offset (-headroom) satisfies `headlen - offset >= len`
and reads uninitialized skb->head headroom before skb->data (or before
skb_mac_header(skb) if mac_header was set without setting network_header).

Validate that skb->network_header is >= skb->mac_header when the MAC
header is set, or that skb_network_offset(skb) >= 0 and a network
protocol/header is present otherwise, returning INT_MIN (-EFAULT) when
the network header is unset.

Fixes: d4bac0288a2b ("bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/net/core/filter.c b/net/core/filter.c
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -231,8 +231,14 @@ static int bpf_skb_load_helper_convert_offset(const struct sk_buff *skb, int off
 	if (likely(offset >= 0))
 		return offset;
 
-	if (offset >= SKF_NET_OFF)
+	if (offset >= SKF_NET_OFF) {
+		if (skb_mac_header_was_set(skb) ?
+		    skb->network_header < skb->mac_header :
+		    (skb_network_offset(skb) < 0 ||
+		     (!skb->protocol && !skb->network_header)))
+			return INT_MIN;
 		return offset - SKF_NET_OFF + skb_network_offset(skb);
+	}
 
 	if (offset >= SKF_LL_OFF && skb_mac_header_was_set(skb))
 		return offset - SKF_LL_OFF + skb_mac_offset(skb);
-- 
2.43.0

On Sat, Sep 19, 2026 at 08:35 PM Hui Peng <benquike@gmail.com> wrote:
> diff --git a/net/core/filter.c b/net/core/filter.c
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -231,8 +231,14 @@ static int bpf_skb_load_helper_convert_offset(const struct sk_buff *skb, int off
>  	if (likely(offset >= 0))
>  		return offset;
>
> -	if (offset >= SKF_NET_OFF)
> +	if (offset >= SKF_NET_OFF) {
> +		if (skb_mac_header_was_set(skb) ?
> +		    skb->network_header < skb->mac_header :
> +		    (skb_network_offset(skb) < 0 ||
> +		     (!skb->protocol && !skb->network_header)))
> +			return INT_MIN;

No. network_header == 0 is a valid value when there is no headroom and
skb->protocol says nothing about it.

When netlink_dump() had this problem it was fixed by
skb_reset_network_header() after skb_reserve(). See
commit 99c07327ae11 ("netlink: reset network and mac headers in netlink_dump()").

pw-bot: cr