On Thu, 30 Jul 2026 05:22:21 -0400 Willem de Bruijn wrote:
Qihang wrote:
quoted
tpacket_snd() reads dev->hard_header_len independently for skb
allocation and header construction in tpacket_fill_skb(). Concurrent
netdevice reconfiguration can therefore make the reserved headroom
smaller than the amount later pushed, or make copylen - hard_header_len
negative.
Snapshot hard_header_len once before processing ring frames and use it
for the frame limit, headroom allocation, copy length, and skb
construction. Pass the snapshot to tpacket_fill_skb().
The separate SOCK_DGRAM consistency problem between hard_header_len and
header_ops->create is not addressed here.
Fixes: 69e3c75f4d54 ("net: TX_RING and packet mmap")
Cc: stable@vger.kernel.org
Signed-off-by: Qihang <redacted>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Willem, does the *shiko feedback look like false positives?
Both instances seem to provide different feedback, if I'm reading my own
tea leaves right Claude discarded the Gemini feedback about a panic
as a hallucination..
https://sashiko.dev/#/patchset/20260730082925.93759-2-q.h.hack.winter@gmail.com
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260730082925.93759-2-q.h.hack.winter@gmail.com