Re: [PATCH net 0/3] net: don't read an unset MAC header on the raw/qdisc-bypass TX path

[Jakub Kicinski <kuba@kernel.org>]

On Mon, 13 Jul 2026 21:40:07 +0200 Doruk Tan Ozturk wrote:
> On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, skb->mac_header
> is left unset when ndo_start_xmit() runs, so eth_hdr(skb) resolves ~64KB out of
> bounds. Commit f5089008f90c ("macsec: don't read an unset MAC header in
> macsec_encrypt()") fixed one instance; these three are the same class in other
> TX/.xmit paths, each reading eth_hdr(skb)->h_dest. On TX the L2 header is at
> skb->data, so use skb_eth_hdr() (a no-op on normal TX where mac_header is set).
> 
> Found by static analysis (0sec); verified against source, not runtime-reproduced.
> Confirmed by an independent cross-check that mac_header is unset on the bypass
> path (__dev_direct_xmit does not reset it). More siblings exist (sja1105 shared
> TX/RX helper, atlantic PTP path) and will follow separately.

If there's one known source of such strange packets we generally try to
fix the problem at the source rather than hardening the whole stack
against bad packets.

Can we make SOCK_RAW + PACKET_QDISC_BYPASS set the header offset
instead? (If not the relevant analysis should be part of the cover
letter).
-- 
pw-bot: cr