* [PATCH] xfrm: fix missing headroom check in xfrm_dev_direct_output
@ 2026-05-17 11:19 Günther Muller
2026-05-18 6:27 ` Steffen Klassert
2026-05-18 8:04 ` [PATCH v2] " Günther Muller
0 siblings, 2 replies; 5+ messages in thread
From: Günther Muller @ 2026-05-17 11:19 UTC (permalink / raw)
To: steffen.klassert, herbert
Cc: davem, edumazet, kuba, pabeni, netdev, linux-kernel,
Günther Muller
Ensure the skb has enough headroom for the hardware offload device's
hard_header_len. If the headroom is insufficient (e.g., when routing
through certain virtual or tunnel devices), __skb_push() underflows
skb->data below skb->head, causing silent memory corruption.
Fix this by using skb_cow_head() to dynamically expand headroom if
needed, and switch to the checked skb_push() variant.
Signed-off-by: Günther Muller <gunther.muller2008@gmail.com>
---
net/xfrm/xfrm_output.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index cc35c2fcbb..35f974d209 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -649,7 +649,10 @@ static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x,
* to netdevice.
*/
skb->dev = x->xso.dev;
- __skb_push(skb, skb->dev->hard_header_len);
+ err = skb_cow_head(skb, skb->dev->hard_header_len);
+ if (err)
+ return err;
+ skb_push(skb, skb->dev->hard_header_len);
return dev_queue_xmit(skb);
}
--
2.39.5
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] xfrm: fix missing headroom check in xfrm_dev_direct_output
2026-05-17 11:19 [PATCH] xfrm: fix missing headroom check in xfrm_dev_direct_output Günther Muller
@ 2026-05-18 6:27 ` Steffen Klassert
2026-05-18 8:04 ` [PATCH v2] " Günther Muller
1 sibling, 0 replies; 5+ messages in thread
From: Steffen Klassert @ 2026-05-18 6:27 UTC (permalink / raw)
To: Günther Muller
Cc: herbert, davem, edumazet, kuba, pabeni, netdev, linux-kernel
On Sun, May 17, 2026 at 01:19:40PM +0200, Günther Muller wrote:
> Ensure the skb has enough headroom for the hardware offload device's
> hard_header_len. If the headroom is insufficient (e.g., when routing
> through certain virtual or tunnel devices), __skb_push() underflows
> skb->data below skb->head, causing silent memory corruption.
>
> Fix this by using skb_cow_head() to dynamically expand headroom if
> needed, and switch to the checked skb_push() variant.
>
> Signed-off-by: Günther Muller <gunther.muller2008@gmail.com>
As this is a fix, please add a 'Fixes:' tag to the commit message.
Thanks!
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v2] xfrm: fix missing headroom check in xfrm_dev_direct_output
2026-05-17 11:19 [PATCH] xfrm: fix missing headroom check in xfrm_dev_direct_output Günther Muller
2026-05-18 6:27 ` Steffen Klassert
@ 2026-05-18 8:04 ` Günther Muller
2026-05-18 12:30 ` Leon Romanovsky
1 sibling, 1 reply; 5+ messages in thread
From: Günther Muller @ 2026-05-18 8:04 UTC (permalink / raw)
To: steffen.klassert
Cc: Günther Muller, Herbert Xu, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, netdev, linux-kernel
Ensure the skb has enough headroom for the hardware offload device's
hard_header_len. If the headroom is insufficient (e.g., when routing
through certain virtual or tunnel devices), __skb_push() underflows
skb->data below skb->head, causing silent memory corruption.
Fix this by using skb_cow_head() to dynamically expand headroom if
needed, and switch to the checked skb_push() variant.
Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
Signed-off-by: Günther Muller <gunther.muller2008@gmail.com>
---
net/xfrm/xfrm_output.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index cc35c2fcbb..35f974d209 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -649,7 +649,10 @@ static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x,
* to netdevice.
*/
skb->dev = x->xso.dev;
- __skb_push(skb, skb->dev->hard_header_len);
+ err = skb_cow_head(skb, skb->dev->hard_header_len);
+ if (err)
+ return err;
+ skb_push(skb, skb->dev->hard_header_len);
return dev_queue_xmit(skb);
}
--
2.39.5
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH v2] xfrm: fix missing headroom check in xfrm_dev_direct_output
2026-05-18 8:04 ` [PATCH v2] " Günther Muller
@ 2026-05-18 12:30 ` Leon Romanovsky
0 siblings, 0 replies; 5+ messages in thread
From: Leon Romanovsky @ 2026-05-18 12:30 UTC (permalink / raw)
To: Günther Muller
Cc: steffen.klassert, Herbert Xu, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, netdev, linux-kernel
On Mon, May 18, 2026 at 10:04:09AM +0200, Günther Muller wrote:
> Ensure the skb has enough headroom for the hardware offload device's
> hard_header_len. If the headroom is insufficient (e.g., when routing
> through certain virtual or tunnel devices), __skb_push() underflows
> skb->data below skb->head, causing silent memory corruption.
Could you please provide the steps required to reproduce the issue?
>
> Fix this by using skb_cow_head() to dynamically expand headroom if
> needed, and switch to the checked skb_push() variant.
>
> Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
>
Extra blank line.
> Signed-off-by: Günther Muller <gunther.muller2008@gmail.com>
> ---
> net/xfrm/xfrm_output.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
> index cc35c2fcbb..35f974d209 100644
> --- a/net/xfrm/xfrm_output.c
> +++ b/net/xfrm/xfrm_output.c
> @@ -649,7 +649,10 @@ static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x,
> * to netdevice.
> */
> skb->dev = x->xso.dev;
> - __skb_push(skb, skb->dev->hard_header_len);
> + err = skb_cow_head(skb, skb->dev->hard_header_len);
> + if (err)
> + return err;
> + skb_push(skb, skb->dev->hard_header_len);
> return dev_queue_xmit(skb);
> }
>
> --
> 2.39.5
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v2] xfrm: fix missing headroom check in xfrm_dev_direct_output
@ 2026-05-18 8:23 Günther Muller
0 siblings, 0 replies; 5+ messages in thread
From: Günther Muller @ 2026-05-18 8:23 UTC (permalink / raw)
To: steffen.klassert
Cc: Günther Muller, Herbert Xu, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, netdev, linux-kernel
Ensure the skb has enough headroom for the hardware offload device's
hard_header_len. If the headroom is insufficient (e.g., when routing
through certain virtual or tunnel devices), __skb_push() underflows
skb->data below skb->head, causing silent memory corruption.
Fix this by using skb_cow_head() to dynamically expand headroom if
needed, and switch to the checked skb_push() variant.
Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
Signed-off-by: Günther Muller <gunther.muller2008@gmail.com>
---
net/xfrm/xfrm_output.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index cc35c2fcbb..35f974d209 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -649,7 +649,10 @@ static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x,
* to netdevice.
*/
skb->dev = x->xso.dev;
- __skb_push(skb, skb->dev->hard_header_len);
+ err = skb_cow_head(skb, skb->dev->hard_header_len);
+ if (err)
+ return err;
+ skb_push(skb, skb->dev->hard_header_len);
return dev_queue_xmit(skb);
}
--
2.39.5
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-05-18 12:30 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-17 11:19 [PATCH] xfrm: fix missing headroom check in xfrm_dev_direct_output Günther Muller
2026-05-18 6:27 ` Steffen Klassert
2026-05-18 8:04 ` [PATCH v2] " Günther Muller
2026-05-18 12:30 ` Leon Romanovsky
-- strict thread matches above, loose matches on Subject: below --
2026-05-18 8:23 Günther Muller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox