[PATCH net-next 2/9] net/mlx5e: check for failure when pulling the Ethernet header after XDP

[Josef Bacik <josef@xxxxxxxxxxxxxx>]

When an XDP program leaves less than ETH_HLEN in the linear part of a
multi-buffer packet, mlx5e_skb_from_cqe_mpwrq_nonlinear() pulls the rest
of the Ethernet header in from the frags with __pskb_pull_tail() and
ignores the return value.  If that pull fails, eth_type_trans() later
finds less than ETH_HLEN in the head and BUG()s in __skb_pull().

Use pskb_may_pull() instead and drop the packet if it fails.  Pulling
min(ETH_HLEN, skb->len) keeps today's behaviour for a frame shorter
than an Ethernet header.

Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c 
b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index e3f915beebe1..b1e1e30a77e2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -2060,9 +2060,12 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, 
struct mlx5e_mpw_info *w
                                pagep->frags++;
                        while (++pagep < frag_page);
 
-                       if (len < ETH_HLEN)
-                               __pskb_pull_tail(skb, min(ETH_HLEN - len,
-                                                         skb->data_len));
+                       if (len < ETH_HLEN &&
+                           !pskb_may_pull(skb, min(ETH_HLEN, skb->len))) {
+                               rq->stats->buff_alloc_err++;
+                               dev_kfree_skb_any(skb);
+                               return NULL;
+                       }
                }
        } else {
                if (xdp_buff_has_frags(&mxbuf->xdp)) {

-- 
2.55.0