tc egress actions can leave an skb with fewer than ETH_HLEN bytes in its linear part. loopback_xmit() then crashes in eth_type_trans(): tc qdisc add dev lo clsact tc filter add dev lo egress matchall action vlan pop_eth # AF_PACKET SOCK_RAW: eth / eth / 8192 bytes of payload kernel BUG at include/linux/skbuff.h:2839! RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163) Call Trace: loopback_xmit (drivers/net/loopback.c:87) dev_hard_start_xmit (include/linux/netdevice.h:5455 include/linux/netdevice.h:5464 net/core/dev.c:4057 net/core/dev.c:4073) __dev_queue_xmit (net/core/dev.c:5066) packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189) The same happens with "action ife decode" on lo egress. Use eth_type_trans_careful(), and drop the packet if the Ethernet header can not be pulled. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Vega Link: https://lore.kernel.org/netdev/20261005052249.1914367-2-weir@nebusec.ai/ Signed-off-by: Eric Dumazet --- drivers/net/loopback.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c index 55ecd5ebac0f21b61b64373c429a6f9ba5d15c8e..8a6cb34e6b5f02c88dfb0c6bf112068c4f51fec1 100644 --- a/drivers/net/loopback.c +++ b/drivers/net/loopback.c @@ -70,6 +70,7 @@ EXPORT_SYMBOL(blackhole_netdev); static netdev_tx_t loopback_xmit(struct sk_buff *skb, struct net_device *dev) { + enum skb_drop_reason reason; int len; skb_tx_timestamp(skb); @@ -84,7 +85,12 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb, */ skb_dst_force(skb); - skb->protocol = eth_type_trans(skb, dev); + reason = eth_type_trans_careful(skb, dev); + if (unlikely(reason)) { + dev_core_stats_tx_dropped_inc(dev); + kfree_skb_reason(skb, reason); + return NETDEV_TX_OK; + } len = skb->len; if (likely(__netif_rx(skb) == NET_RX_SUCCESS)) -- 2.53.0