Re: [PATCH net-next v2 03/10] net/mlx5e: check for failure when pulling the Ethernet header after XDP

[Tariq Toukan <tariqt@xxxxxxxxxx>]

On 09/10/2026 0:02, Josef Bacik wrote:
> When an XDP program leaves less than ETH_HLEN in the linear part of a
> multi-buffer packet, mlx5e_skb_from_cqe_mpwrq_nonlinear() pulls the rest
> of the Ethernet header in from the frags with __pskb_pull_tail() and
> ignores the return value.  If that pull fails, eth_type_trans() later
> finds less than ETH_HLEN in the head and BUG()s in __skb_pull().
>
> Use pskb_may_pull() instead and drop the packet if it fails.  Pulling
> min(ETH_HLEN, skb->len) keeps today's behaviour for a frame shorter
> than an Ethernet header.
>
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> ---
>   drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 9 ++++++---
>   1 file changed, 6 insertions(+), 3 deletions(-)
Hi,

I posted relevant comments on V1.

https://lore.kernel.org/all/d2d64d12-24a9-4bf1-b505-3008e0e25c40@xxxxxxxxxx/

> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c 
> b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> index e3f915beebe1..b1e1e30a77e2 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> @@ -2060,9 +2060,12 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, 
> struct mlx5e_mpw_info *w
>                                 pagep->frags++;
>                         while (++pagep < frag_page);
>   
> -			if (len < ETH_HLEN)
> -                               __pskb_pull_tail(skb, min(ETH_HLEN - len,
> -                                                         skb->data_len));
> +                       if (len < ETH_HLEN &&
> +                           !pskb_may_pull(skb, min(ETH_HLEN, skb->len))) {
> +                               rq->stats->buff_alloc_err++;
> +                               dev_kfree_skb_any(skb);
> +                               return NULL;
> +                       }
>                 }
>         } else {
>                 if (xdp_buff_has_frags(&mxbuf->xdp)) {