[PATCH] macsec: skip PACKET_LOOPBACK frames in macsec_handle_frame()

[PATCH] macsec: skip PACKET_LOOPBACK frames in macsec_handle_frame()

[Daniel Hodges]

macsec_handle_frame() assumes all incoming frames have a valid Ethernet
header at skb_mac_header(skb) and reads hdr->eth.h_proto to determine
whether to process the frame as MACsec.  However, loopback packets are
delivered with pkt_type PACKET_LOOPBACK and carry only a
protocol-specific header (e.g. 7-byte phonethdr), not a full Ethernet
header. Reading 14 bytes of ethhdr from such a short header results in a
slab-out-of-bounds / uninit-value access.

Fix this by returning RX_HANDLER_PASS early for PACKET_LOOPBACK frames,
consistent with how macvlan_handle_frame() handles this case.

Reported-by: syzbot+0e665e4b99cb925286a0@syzkaller.appspotmail.com
Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
Signed-off-by: Daniel Hodges <git@danielhodges.dev>
---
 drivers/net/macsec.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 0206b84284ab..edcc51f82327 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -1103,6 +1103,13 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
 	bool pulled_sci;
 	int ret;
 
+	/* Loopback packets (e.g. from phonet) don't have L2 headers, so
+	 * attempting to interpret the mac header as Ethernet would read
+	 * uninitialized memory.  Let them pass through unmodified.
+	 */
+	if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
+		return RX_HANDLER_PASS;
+
 	if (skb_headroom(skb) < ETH_HLEN)
 		goto drop_direct;
 
-- 
2.52.0

Re: [PATCH] macsec: skip PACKET_LOOPBACK frames in macsec_handle_frame()

[Eric Dumazet]

On Mon, Feb 9, 2026 at 5:29 PM Daniel Hodges <git@danielhodges.dev> wrote:
>
> macsec_handle_frame() assumes all incoming frames have a valid Ethernet
> header at skb_mac_header(skb) and reads hdr->eth.h_proto to determine
> whether to process the frame as MACsec.  However, loopback packets are
> delivered with pkt_type PACKET_LOOPBACK and carry only a
> protocol-specific header (e.g. 7-byte phonethdr), not a full Ethernet
> header. Reading 14 bytes of ethhdr from such a short header results in a
> slab-out-of-bounds / uninit-value access.
>
> Fix this by returning RX_HANDLER_PASS early for PACKET_LOOPBACK frames,
> consistent with how macvlan_handle_frame() handles this case.

In the syzbot report, I do not see dev_loopback_xmit() being involved ?

>
> Reported-by: syzbot+0e665e4b99cb925286a0@syzkaller.appspotmail.com
> Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
> Signed-off-by: Daniel Hodges <git@danielhodges.dev>
> ---
>  drivers/net/macsec.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
> index 0206b84284ab..edcc51f82327 100644
> --- a/drivers/net/macsec.c
> +++ b/drivers/net/macsec.c
> @@ -1103,6 +1103,13 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
>         bool pulled_sci;
>         int ret;
>
> +       /* Loopback packets (e.g. from phonet) don't have L2 headers, so
> +        * attempting to interpret the mac header as Ethernet would read
> +        * uninitialized memory.  Let them pass through unmodified.
> +        */
> +       if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
> +               return RX_HANDLER_PASS;
> +
>         if (skb_headroom(skb) < ETH_HLEN)
>                 goto drop_direct;
>
> --
> 2.52.0

I think the issue is in this skb_headroom() check really, this is not
really doing what we need.

Note that the existing check (if (hdr->eth.h_proto !=
htons(ETH_P_MACSEC))) should kick properly
if phonet was able to send a bigger packet.

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index c2cb2d20976b..ef4cdf25d425 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -1141,7 +1141,7 @@ static rx_handler_result_t
macsec_handle_frame(struct sk_buff **pskb)
        bool pulled_sci;
        int ret;

-       if (skb_headroom(skb) < ETH_HLEN)
+       if (!pskb_may_pull(skb, skb_mac_offset(skb) + ETH_HLEN))
                goto drop_direct;

        hdr = macsec_ethhdr(skb);

Re: [PATCH] macsec: skip PACKET_LOOPBACK frames in macsec_handle_frame()

[Daniel Hodges]

On Mon, Feb 09, 2026 at 06:35:46PM +0100, Eric Dumazet wrote:
> On Mon, Feb 9, 2026 at 5:29 PM Daniel Hodges <git@danielhodges.dev> wrote:
> >
> > macsec_handle_frame() assumes all incoming frames have a valid Ethernet
> > header at skb_mac_header(skb) and reads hdr->eth.h_proto to determine
> > whether to process the frame as MACsec.  However, loopback packets are
> > delivered with pkt_type PACKET_LOOPBACK and carry only a
> > protocol-specific header (e.g. 7-byte phonethdr), not a full Ethernet
> > header. Reading 14 bytes of ethhdr from such a short header results in a
> > slab-out-of-bounds / uninit-value access.
> >
> > Fix this by returning RX_HANDLER_PASS early for PACKET_LOOPBACK frames,
> > consistent with how macvlan_handle_frame() handles this case.
> 
> In the syzbot report, I do not see dev_loopback_xmit() being involved ?

I think it doesn't go through dev_loopback_xmit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/phonet/af_phonet.c#n182

> >
> > Reported-by: syzbot+0e665e4b99cb925286a0@syzkaller.appspotmail.com
> > Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
> > Signed-off-by: Daniel Hodges <git@danielhodges.dev>
> > ---
> >  drivers/net/macsec.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
> > index 0206b84284ab..edcc51f82327 100644
> > --- a/drivers/net/macsec.c
> > +++ b/drivers/net/macsec.c
> > @@ -1103,6 +1103,13 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
> >         bool pulled_sci;
> >         int ret;
> >
> > +       /* Loopback packets (e.g. from phonet) don't have L2 headers, so
> > +        * attempting to interpret the mac header as Ethernet would read
> > +        * uninitialized memory.  Let them pass through unmodified.
> > +        */
> > +       if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
> > +               return RX_HANDLER_PASS;
> > +
> >         if (skb_headroom(skb) < ETH_HLEN)
> >                 goto drop_direct;
> >
> > --
> > 2.52.0
> 
> I think the issue is in this skb_headroom() check really, this is not
> really doing what we need.
> 
> Note that the existing check (if (hdr->eth.h_proto !=
> htons(ETH_P_MACSEC))) should kick properly
> if phonet was able to send a bigger packet.
> 
> diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
> index c2cb2d20976b..ef4cdf25d425 100644
> --- a/drivers/net/macsec.c
> +++ b/drivers/net/macsec.c
> @@ -1141,7 +1141,7 @@ static rx_handler_result_t
> macsec_handle_frame(struct sk_buff **pskb)
>         bool pulled_sci;
>         int ret;
> 
> -       if (skb_headroom(skb) < ETH_HLEN)
> +       if (!pskb_may_pull(skb, skb_mac_offset(skb) + ETH_HLEN))
>                 goto drop_direct;
> 
>         hdr = macsec_ethhdr(skb);

Yeah, that seems more likely or should the the loopback side use
dev_loopback_xmit?