AF_PACKET send paths read dev->hard_header_len at several stages of skb
allocation and construction. Concurrent netdevice reconfiguration can
make those reads inconsistent and cause skb headroom underflow.
Split the regular and TX_RING paths so each patch has one Fixes tag.
The separate SOCK_DGRAM consistency issue between hard_header_len and
header_ops->create remains outside this series.
Changes in v3:
- Split into two patches, one Fixes tag each.
- Add LL_RESERVED_SPACE_EX() for calculations using a saved length.
- Use int consistently for saved header lengths.
- Drop unnecessary READ_ONCE(header_ops).
- Snapshot hard_header_len per-frame in the TX_RING path.
- Reset copylen for each frame.
Link to v2: https://lore.kernel.org/netdev/20260726092110.80185-1-q.h.hack.winter@gmail.com/ (local)
Qihang (2):
packet: use consistent hard_header_len in non-ring send paths
packet: use consistent hard_header_len in TX_RING send path
include/linux/netdevice.h | 6 +++--
net/packet/af_packet.c | 47 ++++++++++++++++++++++++---------------
2 files changed, 33 insertions(+), 20 deletions(-)
--
2.50.1 (Apple Git-155)