Re: [PATCH net v4 1/1] net: loopback: reject skbs with a short linear Ethernet header

[Eric Dumazet <edumazet@kernel.org>]

On 10/5/26 07:22, Ren Wei wrote:
> From: Wyatt Feng <bronzed_45_vested@icloud.com>
> 
> loopback_xmit() calls eth_type_trans(), which reads the Ethernet header
> from skb->data and consumes ETH_HLEN bytes. This requires at least
> ETH_HLEN bytes in the skb's linear area.
> 
> An earlier transformation can leave a non-linear skb with fewer than
> ETH_HLEN bytes in the linear area, even when skb->len is at least
> ETH_HLEN. Pulling the header then makes skb->len smaller than
> skb->data_len and triggers the BUG in __skb_pull().
> 
> Check skb_headlen(skb) before calling eth_type_trans(). Reject skbs
> whose linear area is too short, including those whose total length is
> less than ETH_HLEN, without attempting to pull bytes from fragments.
> Free rejected skbs, account them as TX drops and return NETDEV_TX_OK.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Link: https://lore.kernel.org/all/2d4e79d252a57bdad83435999dddf2c4b708dcfa.1785049236.git.bronzed_45_vested@icloud.com/
> Suggested-by: Jamal Hadi Salim <jhs@mojatatu.com>
> Assisted-by: Codex:GPT-5.4
> Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
> Signed-off-by: Ren Wei <enjou1224z@gmail.com>
> ---

NACK

If if we do not fix the root cause, we will have hundreds of drivers to fix.

Stop making linux slower and slower just because you can.