stmmac_construct_skb_zc() reserves headroom for the XDP metadata and records the length reported by the XDP program, but only copies the packet data starting at xdp->data. The bytes in [xdp->data_meta, xdp->data) are never copied into the new skb, so the skb advertises metadata that is not there: after eth_type_trans() anchors mac_header, data_meta points at uninitialized headroom instead of what the program wrote. Copy the metadata together with the packet data starting at xdp->data_meta, leaving skb->data at the start of the frame and the metadata immediately before it, and record its length. This keeps data_meta valid for the stack and TC BPF, and keeps the metadata aligned when stmmac_rx_vlan() relocates it with the MAC header while stripping a tag. Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy") Signed-off-by: Lorenzo Bianconi --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index 30a2774d722b..8a2faf50d695 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -5519,7 +5519,8 @@ static struct sk_buff *stmmac_construct_skb_zc(struct stmmac_channel *ch, return NULL; skb_reserve(skb, xdp->data - xdp->data_hard_start); - memcpy(__skb_put(skb, datasize), xdp->data, datasize); + __skb_put(skb, datasize); + memcpy(skb->data - metasize, xdp->data_meta, datasize + metasize); if (metasize) skb_metadata_set(skb, metasize); -- 2.56.0