RE: [PATCH net-next v2 03/10] net/mlx5e: check for failure when pulling the Ethernet header after XDP

["Loktionov, Aleksandr" <aleksandr.loktionov@xxxxxxxxx>]

> -----Original Message-----
> From: Josef Bacik <josef@xxxxxxxxxxxxxx>
> Sent: Thursday, October 8, 2026 11:03 PM
> To: Jakub Kicinski <kuba@xxxxxxxxxx>; Paolo Abeni <pabeni@xxxxxxxxxx>;
> Eric Dumazet <edumazet@xxxxxxxxxx>; David S. Miller
> <davem@xxxxxxxxxxxxx>; Andrew Lunn <andrew+netdev@xxxxxxx>
> Cc: Saeed Mahameed <saeedm@xxxxxxxxxx>; Tariq Toukan
> <tariqt@xxxxxxxxxx>; Mark Bloch <mbloch@xxxxxxxxxx>; Leon Romanovsky
> <leon@xxxxxxxxxx>; Juergen Gross <jgross@xxxxxxxx>; Stefano Stabellini
> <sstabellini@xxxxxxxxxx>; Oleksandr Tyshchenko
> <oleksandr_tyshchenko@xxxxxxxx>; Nguyen, Anthony L
> <anthony.l.nguyen@xxxxxxxxx>; Kitszel, Przemyslaw
> <przemyslaw.kitszel@xxxxxxxxx>; Manish Chopra <manishc@xxxxxxxxxxx>;
> Rahul Verma <rahulv@xxxxxxxxxxx>; GR-Linux-NIC-Dev@xxxxxxxxxxx; Shahed
> Shaikh <shshaikh@xxxxxxxxxxx>; Simon Horman <horms@xxxxxxxxxx>;
> netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; linux-
> rdma@xxxxxxxxxxxxxxx; xen-devel@xxxxxxxxxxxxxxxxxxxx; intel-wired-
> lan@xxxxxxxxxxxxxxxx; Josef Bacik <josef@xxxxxxxxxxxxxx>
> Subject: [PATCH net-next v2 03/10] net/mlx5e: check for failure when
> pulling the Ethernet header after XDP
> 
> When an XDP program leaves less than ETH_HLEN in the linear part of a
> multi-buffer packet, mlx5e_skb_from_cqe_mpwrq_nonlinear() pulls the rest
> of the Ethernet header in from the frags with __pskb_pull_tail() and
> ignores the return value.  If that pull fails, eth_type_trans() later
> finds less than ETH_HLEN in the head and BUG()s in __skb_pull().
> 
> Use pskb_may_pull() instead and drop the packet if it fails.  Pulling
> min(ETH_HLEN, skb->len) keeps today's behaviour for a frame shorter than
> an Ethernet header.
> 
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> index e3f915beebe1..b1e1e30a77e2 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> @@ -2060,9 +2060,12 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct
> mlx5e_rq *rq, struct mlx5e_mpw_info *w
>                               pagep->frags++;
>                       while (++pagep < frag_page);
> 
> -                     if (len < ETH_HLEN)
> -                             __pskb_pull_tail(skb, min(ETH_HLEN - len,
> -                                                       skb->data_len));
> +                     if (len < ETH_HLEN &&
> +                         !pskb_may_pull(skb, min(ETH_HLEN, skb->len))) {
> +                             rq->stats->buff_alloc_err++;
> +                             dev_kfree_skb_any(skb);
> +                             return NULL;
> +                     }
>               }
>       } else {
>               if (xdp_buff_has_frags(&mxbuf->xdp)) {
> 
> --
> 2.55.0

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@xxxxxxxxx>