Re: [PATCH net v2 0/5] net: fix eth_type_trans() crashes on skbs coming from the stack
flat view
From: Daniel Borkmann <daniel@iogearbox.net>
Date: 2026-10-28 19:31:34
Also in:
bpf
On 10/28/26 6:34 PM, Alexei Starovoitov wrote:
quoted hunk ↗ jump to hunk
On Wed, Oct 28, 2026 at 05:26 AM Eric Dumazet [off-list ref] wrote:quoted
Other eth_type_trans() users already pull the header or never see such skbs:netkit_xmit() has the same problem, I think. It calls eth_skb_pull_mac() directly, not eth_type_trans(). It pulls ETH_HLEN before netkit_run(). The prog can shrink the linear part after that: AF_PACKET SOCK_RAW on nk0 eth (ETH_P_IP) / eth / 8192 bytes tc egress on nk0 vlan pop_eth skb_headlen() == 0 skb_mac_header_len() == 0 netkit_xmit() pskb_may_pull(skb, ETH_HLEN) skb_headlen() == 14 netkit_run() bpf_skb_adjust_room(skb, -1, BPF_ADJ_ROOM_MAC, 0) bpf_skb_generic_pop() off == 0, skb_headlen() == 13 eth_skb_pull_mac() BUG() in __skb_pull() It's an old bug and it doesn't block this series. It can be a follow up. Something like this (compile tested only):diff --git a/drivers/net/netkit.c b/drivers/net/netkit.c index 82e608e..f093103 100644 --- a/drivers/net/netkit.c +++ b/drivers/net/netkit.c@@ -116,6 +116,9 @@ static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev) switch (ret) { case NETKIT_NEXT: case NETKIT_PASS: + /* The prog may have shrunk the linear part */ + if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) + goto drop; eth_skb_pull_mac(skb); skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN); if (likely(__netif_rx(skb) == NET_RX_SUCCESS)) {
Reproduced locally with a BPF selftest, and that fixes it. Feel free to
add my Acked-by.
Thanks,
Daniel