Re: [PATCH net v2 2/5] loopback: use eth_type_trans_careful()

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

Eric Dumazet wrote:
> tc egress actions can leave an skb with fewer than ETH_HLEN bytes in
> its linear part. loopback_xmit() then crashes in eth_type_trans():
> 
>   tc qdisc add dev lo clsact
>   tc filter add dev lo egress matchall action vlan pop_eth
>   # AF_PACKET SOCK_RAW: eth / eth / 8192 bytes of payload
> 
>   kernel BUG at include/linux/skbuff.h:2839!
>   RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163)
>   Call Trace:
>    loopback_xmit (drivers/net/loopback.c:87)
>    dev_hard_start_xmit (include/linux/netdevice.h:5455 include/linux/netdevice.h:5464 net/core/dev.c:4057 net/core/dev.c:4073)
>    __dev_queue_xmit (net/core/dev.c:5066)
>    packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)
> 
> The same happens with "action ife decode" on lo egress.
> 
> Use eth_type_trans_careful(), and drop the packet if the Ethernet
> header can not be pulled.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Vega <vega@nebusec.ai>
> Link: https://lore.kernel.org/netdev/20261005052249.1914367-2-weir@nebusec.ai/
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
> Tested-by: Jamal Hadi Salim <jhs@mojatatu.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>