RE: [PATCH net-next v2 03/10] net/mlx5e: check for failure when pulling the Ethernet header after XDP

-----Original Message-----
From: Josef Bacik <josef@toxicpanda.com>
Sent: Thursday, October 8, 2026 11:03 PM
To: Jakub Kicinski <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>;
Eric Dumazet [off-list ref]; David S. Miller
[off-list ref]; Andrew Lunn [off-list ref]
Cc: Saeed Mahameed <saeedm@nvidia.com>; Tariq Toukan
[off-list ref]; Mark Bloch [off-list ref]; Leon Romanovsky
[off-list ref]; Juergen Gross [off-list ref]; Stefano Stabellini
[off-list ref]; Oleksandr Tyshchenko
[off-list ref]; Nguyen, Anthony L
[off-list ref]; Kitszel, Przemyslaw
[off-list ref]; Manish Chopra [off-list ref];
Rahul Verma [off-list ref]; GR-Linux-NIC-Dev@marvell.com; Shahed
Shaikh [off-list ref]; Simon Horman [off-list ref];
netdev@vger.kernel.org; linux-kernel@vger.kernel.org; linux-
rdma@vger.kernel.org; xen-devel@lists.xenproject.org; intel-wired-
lan@lists.osuosl.org; Josef Bacik [off-list ref]
Subject: [PATCH net-next v2 03/10] net/mlx5e: check for failure when
pulling the Ethernet header after XDP

When an XDP program leaves less than ETH_HLEN in the linear part of a
multi-buffer packet, mlx5e_skb_from_cqe_mpwrq_nonlinear() pulls the rest
of the Ethernet header in from the frags with __pskb_pull_tail() and
ignores the return value.  If that pull fails, eth_type_trans() later
finds less than ETH_HLEN in the head and BUG()s in __skb_pull().

Use pskb_may_pull() instead and drop the packet if it fails.  Pulling
min(ETH_HLEN, skb->len) keeps today's behaviour for a frame shorter than
an Ethernet header.

Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c

b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index e3f915beebe1..b1e1e30a77e2 100644

--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c

@@ -2060,9 +2060,12 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct

mlx5e_rq *rq, struct mlx5e_mpw_info *w
 				pagep->frags++;
 			while (++pagep < frag_page);

-			if (len < ETH_HLEN)
-				__pskb_pull_tail(skb, min(ETH_HLEN - len,
-							  skb->data_len));
+			if (len < ETH_HLEN &&
+			    !pskb_may_pull(skb, min(ETH_HLEN, skb->len))) {
+				rq->stats->buff_alloc_err++;
+				dev_kfree_skb_any(skb);
+				return NULL;
+			}
 		}
 	} else {
 		if (xdp_buff_has_frags(&mxbuf->xdp)) {

--
2.55.0