On Wed, Oct 28, 2026 at 05:26 AM Eric Dumazet <[email protected]> wrote:
> Other eth_type_trans() users already pull the header or never see
> such skbs:
netkit_xmit() has the same problem, I think.
It calls eth_skb_pull_mac() directly, not eth_type_trans().
It pulls ETH_HLEN before netkit_run(). The prog can shrink the linear
part after that:
AF_PACKET SOCK_RAW on nk0 eth (ETH_P_IP) / eth / 8192 bytes
tc egress on nk0
vlan pop_eth skb_headlen() == 0
skb_mac_header_len() == 0
netkit_xmit()
pskb_may_pull(skb, ETH_HLEN) skb_headlen() == 14
netkit_run()
bpf_skb_adjust_room(skb, -1, BPF_ADJ_ROOM_MAC, 0)
bpf_skb_generic_pop() off == 0, skb_headlen() == 13
eth_skb_pull_mac() BUG() in __skb_pull()
It's an old bug and it doesn't block this series.
It can be a follow up.
Something like this (compile tested only):
diff --git a/drivers/net/netkit.c b/drivers/net/netkit.c
index 82e608e..f093103 100644
--- a/drivers/net/netkit.c
+++ b/drivers/net/netkit.c
@@ -116,6 +116,9 @@ static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct
net_device *dev)
switch (ret) {
case NETKIT_NEXT:
case NETKIT_PASS:
+ /* The prog may have shrunk the linear part */
+ if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
+ goto drop;
eth_skb_pull_mac(skb);
skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
if (likely(__netif_rx(skb) == NET_RX_SUCCESS)) {
For the series:
Acked-by: Alexei Starovoitov <[email protected]>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
