Re: [PATCH net v3] net: loopback: ensure Ethernet header is linear before eth_type_trans

On Tue, 4 Aug 2026 17:08:10 -0700 Nebula Security wrote:

Sorry for not including the cover letter in this version. Here is the
root cause analysis and the reproducer. Let me know if this is enough
or we need to send out a v4 with a complete cover letter.

The frame is not short in terms of its total skb length. The problem is
that its linear area becomes shorter than ETH_HLEN before
loopback_xmit() is invoked.

The reproducer sends a large non-linear AF_PACKET skb through loopback.
The loopback egress tc action is executed before the driver's
ndo_start_xmit callback. TCA_VLAN_ACT_POP_ETH calls skb_eth_pop() there
and consumes the only ETH_HLEN bytes in the skb's linear area.

The skb state is approximately:

  before POP_ETH:
    skb->len      = 8206
    skb->data_len = 8192
    skb_headlen() = 14

  after POP_ETH:
    skb->len      = 8192
    skb->data_len = 8192
    skb_headlen() = 0

The skb then continues to loopback_xmit(). eth_type_trans() calls
__skb_pull(skb, ETH_HLEN), but no bytes are linear at that point, which
triggers the BUG.

Shouldn't TCA_VLAN_ACT_POP_ETH make sure another header is accessible
then? Are there other ways for something to strip L2 before the frame
reaches the driver?