> -----Original Message----- > From: Josef Bacik <[email protected]> > Sent: Thursday, October 8, 2026 11:03 PM > To: Jakub Kicinski <[email protected]>; Paolo Abeni <[email protected]>; > Eric Dumazet <[email protected]>; David S. Miller > <[email protected]>; Andrew Lunn <[email protected]> > Cc: Saeed Mahameed <[email protected]>; Tariq Toukan > <[email protected]>; Mark Bloch <[email protected]>; Leon Romanovsky > <[email protected]>; Juergen Gross <[email protected]>; Stefano Stabellini > <[email protected]>; Oleksandr Tyshchenko > <[email protected]>; Nguyen, Anthony L > <[email protected]>; Kitszel, Przemyslaw > <[email protected]>; Manish Chopra <[email protected]>; > Rahul Verma <[email protected]>; [email protected]; Shahed > Shaikh <[email protected]>; Simon Horman <[email protected]>; > [email protected]; [email protected]; linux- > [email protected]; [email protected]; intel-wired- > [email protected]; Josef Bacik <[email protected]> > Subject: [PATCH net-next v2 03/10] net/mlx5e: check for failure when > pulling the Ethernet header after XDP > > When an XDP program leaves less than ETH_HLEN in the linear part of a > multi-buffer packet, mlx5e_skb_from_cqe_mpwrq_nonlinear() pulls the rest > of the Ethernet header in from the frags with __pskb_pull_tail() and > ignores the return value. If that pull fails, eth_type_trans() later > finds less than ETH_HLEN in the head and BUG()s in __skb_pull(). > > Use pskb_may_pull() instead and drop the packet if it fails. Pulling > min(ETH_HLEN, skb->len) keeps today's behaviour for a frame shorter than > an Ethernet header. > > Assisted-by: LLM > Signed-off-by: Josef Bacik <[email protected]> > --- > drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c > b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c > index e3f915beebe1..b1e1e30a77e2 100644 > --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c > @@ -2060,9 +2060,12 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct > mlx5e_rq *rq, struct mlx5e_mpw_info *w > pagep->frags++; > while (++pagep < frag_page); > > - if (len < ETH_HLEN) > - __pskb_pull_tail(skb, min(ETH_HLEN - len, > - skb->data_len)); > + if (len < ETH_HLEN && > + !pskb_may_pull(skb, min(ETH_HLEN, skb->len))) { > + rq->stats->buff_alloc_err++; > + dev_kfree_skb_any(skb); > + return NULL; > + } > } > } else { > if (xdp_buff_has_frags(&mxbuf->xdp)) { > > -- > 2.55.0
Reviewed-by: Aleksandr Loktionov <[email protected]>
