title: Cannot access __skb_buff in eBPF
body: <p>I am trying to access the <code>__sk_buff</code> struct passed within the <code>consume_skb</code> tracepoint. However nothing I tried has worked so far. I am running the kernel version <code>5.4.0</code>. This is what I tried so far, and in what it resulted:</p>
  <p><strong>Loader</strong>
  <a href="https://gist.github.com/marxlaml/2edff67b8178d5ac385d572efec8c732" rel="nofollow noreferrer">gist</a></p>
  <p><strong>Direct access</strong></p>
  <pre class="lang-c prettyprint-override"><code>SEC(&quot;tracepoint/skb/consume_skb&quot;)
  int handle_skb(struct __sk_buff *skb)
  {
      void *data = (void *)(long)skb-&gt;data;
      void *data_end = (void *)(long)skb-&gt;data_end;
      struct ethhdr *eth = data;
      struct iphdr *iph = data + sizeof(*eth);
  
      if (data + sizeof(*eth) &gt; data_end)
          return 0;
  
      if (data + sizeof(*eth) + sizeof(*iph) &gt; data_end)
          return 0;
  
      bpf_trace_printk(&quot;%x\n&quot;, eth-&gt;h_proto);
  
      return 0;
  }
  </code></pre>
  <p>results in:</p>
  <pre><code>libbpf: prog 'handle_skb': BPF program load failed: Permission denied
  libbpf: prog 'handle_skb': -- BEGIN PROG LOAD LOG --
  ; void *data = (void *)(long)skb-&gt;data;
  0: (61) r2 = *(u32 *)(r1 +76)
  ; void *data_end = (void *)(long)skb-&gt;data_end;
  1: (61) r1 = *(u32 *)(r1 +80)
  ; struct iphdr *iph = data + sizeof(*eth);
  2: (bf) r3 = r2
  3: (07) r3 += 14
  ; if (data + sizeof(*eth) &gt; data_end)
  4: (2d) if r3 &gt; r1 goto pc+7
   R1_w=inv(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff)) R2_w=inv(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff)) R3_w=inv(id=0,umin_value=14,umax_value=4294967309,var_off=(0x0; 0x1ffffffff)) R10=fp0
  ;
  5: (bf) r3 = r2
  6: (07) r3 += 34
  ; if (data + sizeof(*eth) &gt; data_end)
  7: (2d) if r3 &gt; r1 goto pc+4
   R1_w=inv(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff)) R2_w=inv(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff)) R3_w=inv(id=0,umin_value=34,umax_value=4294967329,var_off=(0x0; 0x1ffffffff)) R10=fp0
  ; bpf_trace_printk(&quot;%x\n&quot;, eth-&gt;h_proto);
  8: (69) r2 = *(u16 *)(r2 +12)
  R2 invalid mem access 'inv'
  processed 9 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
  -- END PROG LOAD LOG --
  libbpf: failed to load program 'handle_skb'
  libbpf: failed to load object 'skb_bpf'
  libbpf: failed to load BPF skeleton 'skb_bpf': -13
  Failed to load and verify BPF skeleton
  </code></pre>
  <p>The way I understand it, is that direct access to <code>skb</code> is not allowed in this context (why?).</p>
  <p><strong>bpf_skb_load_bytes</strong></p>
  <pre class="lang-c prettyprint-override"><code>SEC(&quot;tracepoint/skb/consume_skb&quot;)
  int handle_skb(struct __sk_buff *skb)
  {
      struct ethhdr *eth;
  
      int ret;
      ret = skb_load_bytes(skb, 0, eth, sizeof(struct ethhdr));
      //Or alternatively
      //ret = bpf_skb_load_bytes(skb, 0, eth, sizeof(struct ethhdr));
  
      if (!ret)
      {
          return 0;
      }
  
      bpf_trace_printk(&quot;%x\n&quot;, eth-&gt;h_proto);
  
      return 0;
  }
  </code></pre>
  <p>which results in:</p>
  <pre><code>libbpf: prog 'handle_skb': BPF program load failed: Invalid argument
  libbpf: prog 'handle_skb': -- BEGIN PROG LOAD LOG --
  ; ret = bpf_skb_load_bytes(skb, 0, eth, sizeof(struct ethhdr));
  0: (b7) r2 = 0
  1: (b7) r4 = 14
  2: (85) call bpf_skb_load_bytes#26
  unknown func bpf_skb_load_bytes#26
  processed 3 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
  -- END PROG LOAD LOG --
  libbpf: failed to load program 'handle_skb'
  libbpf: failed to load object 'skb_bpf'
  libbpf: failed to load BPF skeleton 'skb_bpf': -22
  Failed to load and verify BPF skeleton
  </code></pre>
  <p>This confuses me even more, as <code>bpf_skb_load_bytes</code> should be an available helper function.</p>
  <p>Now I am doubting how to even access and read (not even write) the <code>__sk_buff</code>.
  Is there just no way? Or have I missed something?</p>