On Mon, Jul 13, 2026 at 04:12:20PM -0500, Doruk (0sec) wrote: > Hi Vladimir, > > Thanks for the review. > > I checked the DSA cases with CONFIG_NET_DSA_LOOP=y. Since dsa_loop > normally uses DSA_TAG_PROTO_NONE, I used a local repro-only override > of dsa_loop_get_protocol() to select the relevant tagger, then sent an > AF_PACKET/SOCK_RAW frame with PACKET_QDISC_BYPASS and > sll_protocol=ETH_P_IP through lan1. > > That leaves skb->mac_header unset (65535) on the direct-xmit path. > > For tag_ocelot_8021q, the eth_hdr(skb) version reproduces as: > > BUG: KASAN: slab-out-of-bounds in ocelot_xmit() > > Switching that site to skb_eth_hdr(skb) makes the same reproducer run clean. > > I also checked the LAN937X path the same way by forcing > DSA_TAG_PROTO_LAN937X. The eth_hdr(skb) version reproduces as: > > BUG: KASAN: slab-out-of-bounds in lan937x_xmit() > > and the skb_eth_hdr(skb) version runs clean with the same packet sender. > > So yes, for these DSA TX paths this is a real bug on the > PACKET_QDISC_BYPASS path, not just a future-proofing cleanup. I have > not yet checked ibmveth with a pseries/ibmveth setup.
Thanks for clarifying your testing procedure (and please do not top-post replies). Yes, manually editing dsa_loop_get_protocol() is the current state of the art technology. > For the older DSA commits you listed, I think they should be treated > as stable candidates if they remove eth_hdr()/skb_mac_header() use > from the same TX path. I can go through those individually and send a > follow-up with the exact stable list if that would be useful. Since skb_mac_header() in TX paths is the real problem, I now think those commits should need backporting too. I only reworked the first-order callers of skb_mac_header(), not realizing that eth_hdr() needs rework too - and not having a clear testing procedure at the time. I think it would be great if you could prepare an email to the stable mailing list and to the maintainers.
