Ensure the skb has enough headroom for the hardware offload device's hard_header_len. If the headroom is insufficient (e.g., when routing through certain virtual or tunnel devices), __skb_push() underflows skb->data below skb->head, causing silent memory corruption. Fix this by using skb_cow_head() to dynamically expand headroom if needed, and switch to the checked skb_push() variant. Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode") Signed-off-by: Günther Muller --- net/xfrm/xfrm_output.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index cc35c2fcbb..35f974d209 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -649,7 +649,10 @@ static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x, * to netdevice. */ skb->dev = x->xso.dev; - __skb_push(skb, skb->dev->hard_header_len); + err = skb_cow_head(skb, skb->dev->hard_header_len); + if (err) + return err; + skb_push(skb, skb->dev->hard_header_len); return dev_queue_xmit(skb); } -- 2.39.5