)]}'
{
  "commit": "c9897252a66b43a17d04c19bc7303fd6539a56ba",
  "tree": "36c9d235ac934e9112cb0279ef6be6917351386c",
  "parents": [
    "b7ff0e7a9ae3df2f123807a7e670bc348b1e1b9d",
    "498c631f9c6d74aad4bf43039fa3ce70ae9a8bb7"
  ],
  "author": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Thu Oct 29 09:11:22 2026 -0700"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Thu Oct 29 09:11:23 2026 -0700"
  },
  "message": "Merge branch \u0027net-fix-eth_type_trans-crashes-on-skbs-coming-from-the-stack\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: fix eth_type_trans() crashes on skbs coming from the stack\n\neth_type_trans() assumes ETH_HLEN bytes are present in skb-\u003ehead.\nNIC drivers always provide this, and they should keep using the fast\nversion, without an extra pskb_may_pull().\n\nDevices looping skbs from their transmit path back to their receive\npath get skbs built by the stack instead. tc actions (act_vlan pop_eth,\nact_ife decode), BPF helpers (bpf_skb_change_head() before a redirect)\nor OVS actions (pop_eth followed by pop_mpls/pop_nsh) can leave fewer\nthan ETH_HLEN bytes in the linear part, and eth_type_trans() then hits\nthe BUG() in __skb_pull().\n\nInstead of fixing every producer, or adding a check to all\neth_type_trans() users, fix the few consumers exposed to this:\n\n- Patch 1 adds eth_type_trans_careful(), which pulls the Ethernet\n  header first and returns a drop reason on failure.\n- Patch 2 uses it in loopback_xmit().\n- Patch 3 uses it in __dev_forward_skb2(), used by BPF redirects to\n  ingress and by veth, macvlan, ipvlan, netdevsim and l2tp_eth.\n- Patch 4 uses it in OVS internal_dev_recv(), covering both the MPLS\n  (TEB) and NSH pop cases at once (only the MPLS case was tested).\n- Patch 5 (from Jamal) fixes act_ife decode on egress, which was\n  consuming the inner Ethernet header. This is no longer a crash after\n  patch 2, but egress decode never delivered a correct frame.\n\nOther eth_type_trans() users already pull the header or never see\nsuch skbs:\n- vrf_process_v{4,6}_outbound() already pull ETH_HLEN + IP header\n  before vrf_local_xmit().\n- tun already uses pskb_may_pull_reason(skb, ETH_HLEN).\n- XDP: bpf_xdp_adjust_head() and bpf_xdp_adjust_tail() keep at least\n  ETH_HLEN bytes in the linear part, and multi-buffer tail shrinking\n  only trims frags.\n\nTested under virtme-ng with AF_PACKET reproducers. Without the series,\nall four cases crash in eth_type_trans():\n- lo egress \"action vlan pop_eth\", eth/eth/8192 bytes frame\n- lo egress \"action ife decode pipe\", IFE frame with 8192 bytes payload\n- lo egress \"action vlan pop_eth continue\", then a BPF program doing\n  bpf_skb_change_head(skb, 1, 0) + bpf_redirect(veth1, BPF_F_INGRESS)\n- OVS flow \"pop_eth,pop_mpls(0x6558),0\" to the internal port,\n  eth/mpls/eth/4096 bytes frame\nWith the series, no crash. An ICMP echo inside an IFE frame decoded\non lo egress is now received and answered. Normal traffic on lo,\nveth (including 8000 byte pings) and vrf is unchanged.\n\nLink: https://lore.kernel.org/netdev/20261005052249.1914367-2-weir@nebusec.ai/\nLink: https://lore.kernel.org/netdev/ACT-N6N4.v3.r0.20261023200137-4@mojatatu.com/\nv1: https://lore.kernel.org/netdev/20261027082604.1485903-1-edumazet@kernel.org/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261028122703.2093730-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": []
}