Re: [PATCH net v3] net: loopback: ensure Ethernet header is linear before eth_type_trans

[Jakub Kicinski <kuba@kernel.org>]

On Tue, 4 Aug 2026 17:08:10 -0700 Nebula Security wrote:
> Sorry for not including the cover letter in this version. Here is the
> root cause analysis and the reproducer. Let me know if this is enough
> or we need to send out a v4 with a complete cover letter.
> 
> The frame is not short in terms of its total skb length. The problem is
> that its linear area becomes shorter than ETH_HLEN before
> loopback_xmit() is invoked.
> 
> The reproducer sends a large non-linear AF_PACKET skb through loopback.
> The loopback egress tc action is executed before the driver's
> ndo_start_xmit callback. TCA_VLAN_ACT_POP_ETH calls skb_eth_pop() there
> and consumes the only ETH_HLEN bytes in the skb's linear area.
> 
> The skb state is approximately:
> 
>   before POP_ETH:
>     skb->len      = 8206
>     skb->data_len = 8192
>     skb_headlen() = 14
> 
>   after POP_ETH:
>     skb->len      = 8192
>     skb->data_len = 8192
>     skb_headlen() = 0
> 
> The skb then continues to loopback_xmit(). eth_type_trans() calls
> __skb_pull(skb, ETH_HLEN), but no bytes are linear at that point, which
> triggers the BUG.

Shouldn't TCA_VLAN_ACT_POP_ETH make sure another header is accessible
then? Are there other ways for something to strip L2 before the frame
reaches the driver?