From 2519a6fe7a8bba57a961eb804e43e7df35ac40fe Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Wed, 28 Oct 2026 13:26:59 +0100 Subject: [PATCH 1/5] net: add eth_type_trans_careful() eth_type_trans() assumes ETH_HLEN bytes are present in skb->head. NIC drivers always provide this, and they should keep using the fast version. Devices looping skbs from their transmit path back to their receive path get skbs built by the stack instead. Their link-layer header might have been popped by tc actions (act_vlan pop_eth, act_ife decode) or OVS actions (pop_eth + pop_mpls / pop_nsh), leaving fewer than ETH_HLEN bytes in the linear part. eth_type_trans() then hits the BUG() in __skb_pull(). Add eth_type_trans_careful(), which first pulls the Ethernet header, and returns a drop reason on failure, so that the few devices exposed to this can drop such packets. Signed-off-by: Eric Dumazet Reviewed-by: Aaron Conole Reviewed-by: Willem de Bruijn Reviewed-by: Jamal Hadi Salim Tested-by: Jamal Hadi Salim Acked-by: Alexei Starovoitov Link: https://patch.msgid.link/20261028122703.2093730-2-edumazet@kernel.org Signed-off-by: Jakub Kicinski --- include/linux/etherdevice.h | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h index df8f88f63a70..1f833ebd71ed 100644 --- a/include/linux/etherdevice.h +++ b/include/linux/etherdevice.h @@ -38,6 +38,34 @@ int fwnode_get_mac_address(struct fwnode_handle *fwnode, char *addr); u32 eth_get_headlen(const struct net_device *dev, const void *data, u32 len); __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev); + +/** + * eth_type_trans_careful - eth_type_trans() for skbs coming from the stack + * @skb: buffer, possibly with less than ETH_HLEN bytes in its linear area + * @dev: receiving network device + * + * eth_type_trans() expects ETH_HLEN bytes in skb->head, which NIC drivers + * provide. Devices looping skbs from their transmit path back to the + * receive path (loopback, OVS internal ports) get skbs built by the stack, + * whose link-layer header might have been popped by tc or OVS actions. + * + * Sets skb->protocol on success. + * + * Return: SKB_NOT_DROPPED_YET on success, or a drop reason. In the latter + * case, the caller must free @skb. + */ +static inline enum skb_drop_reason +eth_type_trans_careful(struct sk_buff *skb, struct net_device *dev) +{ + enum skb_drop_reason reason = pskb_may_pull_reason(skb, ETH_HLEN); + + if (unlikely(reason)) + return reason; + + skb->protocol = eth_type_trans(skb, dev); + return SKB_NOT_DROPPED_YET; +} + extern const struct header_ops eth_header_ops; int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type, From 093a28998374f4007ffe67cc661f8192c1b062a9 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Wed, 28 Oct 2026 13:27:00 +0100 Subject: [PATCH 2/5] loopback: use eth_type_trans_careful() tc egress actions can leave an skb with fewer than ETH_HLEN bytes in its linear part. loopback_xmit() then crashes in eth_type_trans(): tc qdisc add dev lo clsact tc filter add dev lo egress matchall action vlan pop_eth # AF_PACKET SOCK_RAW: eth / eth / 8192 bytes of payload kernel BUG at include/linux/skbuff.h:2839! RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163) Call Trace: loopback_xmit (drivers/net/loopback.c:87) dev_hard_start_xmit (include/linux/netdevice.h:5455 include/linux/netdevice.h:5464 net/core/dev.c:4057 net/core/dev.c:4073) __dev_queue_xmit (net/core/dev.c:5066) packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189) The same happens with "action ife decode" on lo egress. Use eth_type_trans_careful(), and drop the packet if the Ethernet header can not be pulled. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Vega Link: https://lore.kernel.org/netdev/20261005052249.1914367-2-weir@nebusec.ai/ Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Tested-by: Jamal Hadi Salim Acked-by: Alexei Starovoitov Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20261028122703.2093730-3-edumazet@kernel.org Signed-off-by: Jakub Kicinski --- drivers/net/loopback.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c index 55ecd5ebac0f..8a6cb34e6b5f 100644 --- a/drivers/net/loopback.c +++ b/drivers/net/loopback.c @@ -70,6 +70,7 @@ EXPORT_SYMBOL(blackhole_netdev); static netdev_tx_t loopback_xmit(struct sk_buff *skb, struct net_device *dev) { + enum skb_drop_reason reason; int len; skb_tx_timestamp(skb); @@ -84,7 +85,12 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb, */ skb_dst_force(skb); - skb->protocol = eth_type_trans(skb, dev); + reason = eth_type_trans_careful(skb, dev); + if (unlikely(reason)) { + dev_core_stats_tx_dropped_inc(dev); + kfree_skb_reason(skb, reason); + return NETDEV_TX_OK; + } len = skb->len; if (likely(__netif_rx(skb) == NET_RX_SUCCESS)) From 695e1408eb908ac7acf78069933201f92b95727c Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Wed, 28 Oct 2026 13:27:01 +0100 Subject: [PATCH 3/5] net: use eth_type_trans_careful() in __dev_forward_skb2() A tc egress BPF program can push a tiny link-layer header with bpf_skb_change_head() on an skb whose head is almost empty, then redirect it to an Ethernet device ingress. __bpf_redirect_common() only checks mac_header < network_header, and __dev_forward_skb2() crashes in eth_type_trans(): tc filter add dev lo egress pref 1 matchall action vlan pop_eth continue tc filter add dev lo egress pref 2 bpf da obj prog.o # prog: bpf_skb_change_head(skb, 1, 0); # return bpf_redirect(veth1_ifindex, BPF_F_INGRESS); # AF_PACKET SOCK_RAW on lo: eth / eth / 8192 bytes of payload kernel BUG at include/linux/skbuff.h:2839! RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163) Call Trace: __dev_forward_skb2 (net/core/dev.c:2507) dev_forward_skb_nomtu (net/core/dev.c:2546) __dev_queue_xmit (net/core/dev.c:4738 net/core/dev.c:4998) packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189) Use eth_type_trans_careful(), and drop the packet if the Ethernet header can not be pulled. This also covers other dev_forward_skb() users (veth, macvlan, ipvlan, netdevsim, l2tp_eth). Update the empty_skb BPF selftest: at lwt_xmit, BPF_PROG_TEST_RUN strips the Ethernet header, so the "veth ETH_HLEN+1" packet is a 1-byte skb. Redirecting it to veth ingress used to read the Ethernet header past skb->tail and deliver a 1-byte frame; it is now dropped with NET_RX_DROP, as veth_xmit() already does at egress. Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure") Signed-off-by: Eric Dumazet Reviewed-by: Jamal Hadi Salim Tested-by: Jamal Hadi Salim Acked-by: Alexei Starovoitov Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20261028122703.2093730-4-edumazet@kernel.org Signed-off-by: Jakub Kicinski --- net/core/dev.c | 18 +++++++++++++----- .../selftests/bpf/prog_tests/empty_skb.c | 19 ++++++++++++------- 2 files changed, 25 insertions(+), 12 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index 87a79d6004c8..3ac700d37e59 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -2501,14 +2501,22 @@ EXPORT_SYMBOL_GPL(is_skb_forwardable); static int __dev_forward_skb2(struct net_device *dev, struct sk_buff *skb, bool check_mtu) { - int ret = ____dev_forward_skb(dev, skb, check_mtu); + enum skb_drop_reason reason; + int ret; - if (likely(!ret)) { - skb->protocol = eth_type_trans(skb, dev); - skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN); + ret = ____dev_forward_skb(dev, skb, check_mtu); + if (unlikely(ret)) + return ret; + + reason = eth_type_trans_careful(skb, dev); + if (unlikely(reason)) { + dev_core_stats_rx_dropped_inc(dev); + kfree_skb_reason(skb, reason); + return NET_RX_DROP; } + skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN); - return ret; + return 0; } int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb) diff --git a/tools/testing/selftests/bpf/prog_tests/empty_skb.c b/tools/testing/selftests/bpf/prog_tests/empty_skb.c index c9fcb70cbafb..a3938c16557b 100644 --- a/tools/testing/selftests/bpf/prog_tests/empty_skb.c +++ b/tools/testing/selftests/bpf/prog_tests/empty_skb.c @@ -24,7 +24,7 @@ void test_empty_skb(void) int *ifindex; int err; int ret; - int lwt_egress_ret; /* expected retval at lwt/egress */ + int lwt_ret; /* expected retval at lwt */ __be16 h_proto; bool success_on_tc; bool adjust_room; @@ -82,7 +82,7 @@ void test_empty_skb(void) .data_size_in = sizeof(eth_hlen), .ifindex = &veth_ifindex, .ret = -ERANGE, - .lwt_egress_ret = -ERANGE, + .lwt_ret = -ERANGE, .success_on_tc = true, }, { @@ -96,17 +96,23 @@ void test_empty_skb(void) .data_size_in = sizeof(eth_hlen), .ifindex = &ipip_ifindex, .ret = -ERANGE, - .lwt_egress_ret = -ERANGE, + .lwt_ret = -ERANGE, }, - /* ETH_HLEN+1-sized packet should be redirected. */ + /* ETH_HLEN+1-sized packet should be redirected at TC. + * At LWT, the Ethernet header is not part of the skb, and + * a 1-byte packet is too short for an Ethernet device. + */ { .msg = "veth ETH_HLEN+1 packet ingress", .data_in = eth_hlen_pp, .data_size_in = sizeof(eth_hlen_pp), .ifindex = &veth_ifindex, - .lwt_egress_ret = 1, /* veth_xmit NET_XMIT_DROP */ + /* lwt: skb->len=1, dropped by veth_xmit() at egress + * and by __dev_forward_skb2() at ingress. + */ + .lwt_ret = 1, /* NET_XMIT_DROP / NET_RX_DROP */ }, { .msg = "ipip ETH_HLEN+1 packet ingress", @@ -144,7 +150,6 @@ void test_empty_skb(void) eth_hlen.h_proto = tests[i].h_proto; bpf_object__for_each_program(prog, bpf_obj->obj) { - bool at_egress = strstr(bpf_program__name(prog), "egress") != NULL; bool at_tc = !strncmp(bpf_program__section_name(prog), "tc", 2); bool is_adjust_room = !strcmp(bpf_program__name(prog), "tc_adjust_room"); int expected_ret; @@ -153,7 +158,7 @@ void test_empty_skb(void) if (tests[i].adjust_room != is_adjust_room) continue; - expected_ret = at_egress && !at_tc ? tests[i].lwt_egress_ret : tests[i].ret; + expected_ret = at_tc ? tests[i].ret : tests[i].lwt_ret; tattr.data_in = tests[i].data_in; tattr.data_size_in = tests[i].data_size_in; From b55e5a0159c8f53edefcb7848d95eb93db37bce1 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Wed, 28 Oct 2026 13:27:02 +0100 Subject: [PATCH 4/5] openvswitch: use eth_type_trans_careful() in internal_dev_recv() OVS actions like pop_eth followed by pop_mpls(ETH_P_TEB) or pop_nsh can expose an inner Ethernet header which is not in the linear part of the skb. Output to an internal port then crashes in eth_type_trans(): flow: in_port(0),eth(),eth_type(0x8847),mpls(lse=0x00010140) actions: pop_eth,pop_mpls(0x6558),0 # AF_PACKET SOCK_RAW on dp0: eth / mpls / eth / 4096 bytes of payload kernel BUG at include/linux/skbuff.h:2839! RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163) Call Trace: internal_dev_recv (net/openvswitch/vport-internal_dev.c:202) openvswitch do_execute_actions (net/openvswitch/actions.c:1296) openvswitch ovs_execute_actions (net/openvswitch/actions.c:1606) openvswitch ovs_dp_process_packet (net/openvswitch/datapath.c:310) openvswitch ovs_vport_receive (net/openvswitch/vport.c:448) openvswitch internal_dev_xmit (net/openvswitch/vport-internal_dev.c:42) openvswitch dev_hard_start_xmit (include/linux/netdevice.h:5455 include/linux/netdevice.h:5464 net/core/dev.c:4057 net/core/dev.c:4073) __dev_queue_xmit (net/core/dev.c:5066) packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189) Use eth_type_trans_careful(), and drop the packet if the Ethernet header can not be pulled. This covers all OVS actions at the consumer, instead of fixing each producer. Fixes: b2d0f5d5dc53 ("openvswitch: enable NSH support") Fixes: f66b53fdbb22 ("openvswitch: New MPLS actions for layer 2 tunnelling") Signed-off-by: Eric Dumazet Reviewed-by: Aaron Conole Reviewed-by: Jamal Hadi Salim Tested-by: Jamal Hadi Salim Acked-by: Alexei Starovoitov Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20261028122703.2093730-5-edumazet@kernel.org Signed-off-by: Jakub Kicinski --- net/openvswitch/vport-internal_dev.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c index 77a16d5ebd54..8f035087f0ee 100644 --- a/net/openvswitch/vport-internal_dev.c +++ b/net/openvswitch/vport-internal_dev.c @@ -188,6 +188,7 @@ static void internal_dev_destroy(struct vport *vport) static int internal_dev_recv(struct sk_buff *skb) { struct net_device *netdev = skb->dev; + enum skb_drop_reason reason; if (unlikely(!(netdev->flags & IFF_UP))) { kfree_skb(skb); @@ -199,7 +200,12 @@ static int internal_dev_recv(struct sk_buff *skb) nf_reset_ct(skb); skb->pkt_type = PACKET_HOST; - skb->protocol = eth_type_trans(skb, netdev); + reason = eth_type_trans_careful(skb, netdev); + if (unlikely(reason)) { + dev_core_stats_rx_dropped_inc(netdev); + kfree_skb_reason(skb, reason); + return NETDEV_TX_OK; + } skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN); dev_sw_netstats_rx_add(netdev, skb->len); From 498c631f9c6d74aad4bf43039fa3ce70ae9a8bb7 Mon Sep 17 00:00:00 2001 From: Jamal Hadi Salim Date: Wed, 28 Oct 2026 13:27:03 +0100 Subject: [PATCH 5/5] net/sched: act_ife: do not consume the inner header on egress The issue: tcf_ife_decode() unconditionally calls eth_type_trans(), which pulls ETH_HLEN. On egress this consumes the inner Ethernet header, and the device receives an skb whose data points to the L3 header: - loopback_xmit() parses L3 data as Ethernet: the "ethertype" comes from the inner IPv4 source address, and the decapsulated packet is dropped or misparsed. - a real NIC transmits the frame without its Ethernet header. (The __skb_pull() BUG this used to trigger in loopback_xmit() when the remaining linear area was short is handled by "loopback: use eth_type_trans_careful()".) The Fix: Parse the inner Ethernet header with eth_type_trans() in both directions, then restore the egress data position and MAC length. On ingress the existing behavior is unchanged. On egress, push the inner Ethernet header back after parsing so the xmit path sees the original frame and later actions see a consistent network header. Conditions to recreate the bug: - egress tc filter on lo: action ife decode pipe; - AF_PACKET SOCK_RAW frame: outer Ethernet with ETH_P_IFE, IFE metadata, inner Ethernet + a valid IPv4 ICMP echo request to a local address; - before this patch, no echo is received; after it, the echo is delivered and answered. Fixes: ef6980b6becb ("introduce IFE action") Cc: stable@vger.kernel.org Signed-off-by: Jamal Hadi Salim [edumazet: reworded changelog, the crash is now handled in loopback] Signed-off-by: Eric Dumazet Acked-by: Alexei Starovoitov Link: https://patch.msgid.link/20261028122703.2093730-6-edumazet@kernel.org Signed-off-by: Jakub Kicinski --- net/sched/act_ife.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c index 2afd68983ece..3946a9589bb8 100644 --- a/net/sched/act_ife.c +++ b/net/sched/act_ife.c @@ -769,6 +769,10 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a, skb->protocol = eth_type_trans(skb, skb->dev); skb_reset_network_header(skb); + if (!skb_at_tc_ingress(skb)) { + skb_push(skb, ETH_HLEN); + skb_reset_mac_len(skb); + } return action; }