e1000_xmit_frame() uses __pskb_pull_tail() to pull up to 4 bytes of payload into the head when the head holds only the TSO headers. It already checks the result. Switch to pskb_may_pull(), which takes the length the head should end up with and checks it against the skb, so this driver no longer calls __pskb_pull_tail() directly.
Assisted-by: LLM Signed-off-by: Josef Bacik <[email protected]> --- drivers/net/ethernet/intel/e1000e/netdev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c index 844f31ab37ad..e216868e15cb 100644 --- a/drivers/net/ethernet/intel/e1000e/netdev.c +++ b/drivers/net/ethernet/intel/e1000e/netdev.c @@ -5859,8 +5859,8 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb, unsigned int pull_size; pull_size = min_t(unsigned int, 4, skb->data_len); - if (!__pskb_pull_tail(skb, pull_size)) { - e_err("__pskb_pull_tail failed.\n"); + if (!pskb_may_pull(skb, len + pull_size)) { + e_err("pskb_may_pull failed.\n"); dev_kfree_skb_any(skb); return NETDEV_TX_OK; } -- 2.55.0
