When an XDP program leaves less than ETH_HLEN in the linear part of a multi-buffer packet, mlx5e_skb_from_cqe_mpwrq_nonlinear() pulls the rest of the Ethernet header in from the frags with __pskb_pull_tail() and ignores the return value. If that pull fails, eth_type_trans() later finds less than ETH_HLEN in the head and BUG()s in __skb_pull(). Use pskb_may_pull() instead and drop the packet if it fails. Pulling min(ETH_HLEN, skb->len) keeps today's behaviour for a frame shorter than an Ethernet header. Assisted-by: LLM Signed-off-by: Josef Bacik --- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c index e3f915beebe1..b1e1e30a77e2 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c @@ -2060,9 +2060,12 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w pagep->frags++; while (++pagep < frag_page); - if (len < ETH_HLEN) - __pskb_pull_tail(skb, min(ETH_HLEN - len, - skb->data_len)); + if (len < ETH_HLEN && + !pskb_may_pull(skb, min(ETH_HLEN, skb->len))) { + rq->stats->buff_alloc_err++; + dev_kfree_skb_any(skb); + return NULL; + } } } else { if (xdp_buff_has_frags(&mxbuf->xdp)) { -- 2.55.0