Re: [PATCH net v2 0/5] net: fix eth_type_trans() crashes on skbs coming from the stack

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Wed, Oct 28, 2026 at 05:26 AM Eric Dumazet <edumazet@kernel.org> wrote:
> Other eth_type_trans() users already pull the header or never see
> such skbs:

netkit_xmit() has the same problem, I think.
It calls eth_skb_pull_mac() directly, not eth_type_trans().
It pulls ETH_HLEN before netkit_run(). The prog can shrink the linear
part after that:

  AF_PACKET SOCK_RAW on nk0          eth (ETH_P_IP) / eth / 8192 bytes
  tc egress on nk0
    vlan pop_eth                     skb_headlen() == 0
                                     skb_mac_header_len() == 0
  netkit_xmit()
    pskb_may_pull(skb, ETH_HLEN)     skb_headlen() == 14
    netkit_run()
      bpf_skb_adjust_room(skb, -1, BPF_ADJ_ROOM_MAC, 0)
        bpf_skb_generic_pop()        off == 0, skb_headlen() == 13
    eth_skb_pull_mac()               BUG() in __skb_pull()

It's an old bug and it doesn't block this series.
It can be a follow up.

Something like this (compile tested only):

diff --git a/drivers/net/netkit.c b/drivers/net/netkit.c
index 82e608e..f093103 100644
--- a/drivers/net/netkit.c
+++ b/drivers/net/netkit.c
@@ -116,6 +116,9 @@ static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev)
 	switch (ret) {
 	case NETKIT_NEXT:
 	case NETKIT_PASS:
+		/* The prog may have shrunk the linear part */
+		if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
+			goto drop;
 		eth_skb_pull_mac(skb);
 		skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
 		if (likely(__netif_rx(skb) == NET_RX_SUCCESS)) {

For the series:
Acked-by: Alexei Starovoitov <ast@kernel.org>