Re: [PATCH net-next 2/9] net/mlx5e: check for failure when pulling the Ethernet header after XDP

[Tariq Toukan <tariqt@xxxxxxxxxx>]

On 07/10/2026 21:16, Josef Bacik wrote:
> When an XDP program leaves less than ETH_HLEN in the linear part of a
> multi-buffer packet, mlx5e_skb_from_cqe_mpwrq_nonlinear() pulls the rest
> of the Ethernet header in from the frags with __pskb_pull_tail() and
> ignores the return value.  If that pull fails, eth_type_trans() later
> finds less than ETH_HLEN in the head and BUG()s in __skb_pull().
>
> Use pskb_may_pull() instead and drop the packet if it fails.  Pulling
> min(ETH_HLEN, skb->len) keeps today's behaviour for a frame shorter
> than an Ethernet header.
>
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> ---
>   drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 9 ++++++---
>   1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c 
> b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> index e3f915beebe1..b1e1e30a77e2 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> @@ -2060,9 +2060,12 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, 
> struct mlx5e_mpw_info *w
>                                 pagep->frags++;
>                         while (++pagep < frag_page);
>   
> -			if (len < ETH_HLEN)
> -                               __pskb_pull_tail(skb, min(ETH_HLEN - len,
> -                                                         skb->data_len));
> +                       if (len < ETH_HLEN &&
> +                           !pskb_may_pull(skb, min(ETH_HLEN, skb->len))) {
> +                               rq->stats->buff_alloc_err++;
> +                               dev_kfree_skb_any(skb);
> +                               return NULL;
I understand that the real goal is the API change, not this branch.

As of today, this is dead code.
I'd at least mention this in the commit message. You already do so in 
the cover letter, but it vanishes...
Something like:
  This can't fail today, since the head always has at least
  MLX5E_RX_MAX_HEAD bytes of tailroom and the skb is not cloned.

> +                       }
>                 }
>         } else {
>                 if (xdp_buff_has_frags(&mxbuf->xdp)) {