[PATCH net-next v8 4/5] net: stmmac: fix VLAN tag stripping on non-linear RX frames

[Nicolai Buchwitz]

On 18.10.2026 19:07, Lorenzo Bianconi wrote:
> stmmac_rx_vlan() reads the VLAN header straight from skb->data and
> removes it with skb_pull(), assuming the header is always in the linear
> part of the skb. That is not true once non-linear skbs can reach it: a
> program loaded with BPF_F_XDP_HAS_FRAGS can pass up a fragmented frame
> whose linear head has been shortened to as little as ETH_HLEN by
> bpf_xdp_adjust_head(), and the unguarded skb_pull() then drives 
> skb->len
> below skb->data_len, tripping BUG() in __skb_pull().
> 
> Pull the VLAN header into the linear part with pskb_may_pull() before
> touching it and re-derive the header pointer afterwards, as
> pskb_may_pull() may reallocate the skb head. Also move the XDP metadata
> written with bpf_xdp_adjust_meta() together with the MAC header when 
> the
> tag is popped, so data_meta still points at the metadata after
> eth_type_trans() anchors mac_header, instead of at the first bytes of
> the destination MAC. Return an error so the callers can drop the frame
> when the header cannot be pulled.
> 
> Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy")
> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi at oss.qualcomm.com>

> [...]

Reviewed-by: Nicolai Buchwitz <nb at tipi-net.de>

Thanks,
Nicolai