From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f178.google.com (mail-qt1-f178.google.com [209.85.160.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A3C54DEC34 for ; Wed, 7 Oct 2026 18:16:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791396997; cv=none; b=miJ7iO5ccIiCrLDvZFGeww4YSBOGm7XzRIxh2gFB6EpuJo6K4GAQ/KCe+yjr9fHJyPPX6+3lMo3tKuWhz0F6L184xbGsNWWu5rvFSHTSGXRQdkcZ7LP8TyHYVcy11DNoXK5Voj8z79fptvR5Q/IYpXWpNOgpP6xFark41RMPEdk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791396997; c=relaxed/simple; bh=YaVSidg1Bo1cVWoGQJzV4z/nBT+SLxbK+9NmCYkL+oY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=DYj3v6+61FNPY13q26anU1EIKMxJdb8KmykA2YHYY4Zzo0TbVSUhHZrXCJy8H5pufu3VMJXnmmFR9AUPgL+YR9YhqEZDEL4PfYgfXS9Jln/xm0JWmZx9jFNSJpgriShcHoG7t75JzItNP5vsexq5K4RwgKd26Q3N0s+S0JTffFA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=toxicpanda.com; spf=pass smtp.mailfrom=toxicpanda.com; dkim=pass (2048-bit key) header.d=toxicpanda.com header.i=@toxicpanda.com header.b=lvQCrl+R; arc=none smtp.client-ip=209.85.160.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=toxicpanda.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=toxicpanda.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=toxicpanda.com header.i=@toxicpanda.com header.b="lvQCrl+R" Received: by mail-qt1-f178.google.com with SMTP id d75a77b69052e-5350cc60b51so35409171cf.1 for ; Wed, 07 Oct 2026 11:16:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1791396994; x=1792001794; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=a3FpKl0vN7petfzZgqIhlc2NP9KQ4OIDsR/ta4Cqq6o=; b=lvQCrl+RoI+yFumjZBSAaszStUuxGwx6XRx6oEqnfHCSH7HACC4TJOH2ezqbmxnSM9 QeCrOqDxLbAlYJJ1MZd4z8u4MQOq/MUVqjpmROQRRfLlSfpmQmkNnQ63UxQuRhMXxpBa 1jD/J5AtAvEB1v8PnIg6KBNR2c2PtrCBfb+5dyWZZRVvk1NY0lDBF0DyXtMxNR6B4zO1 h7UrHzrGyeg6AFq2/2ESr2MEeJ0vjPV6eLJ76C5AedOmFu6B3hIc6R9mbQOkRYGKGTXn qHSF5EaNs0bRUFeSySTL2u6BMZRQI32QMs4+RQ6TM1zP1KEIjeXLlZZ2E2dwSEDi/LpD usuA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791396994; x=1792001794; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=a3FpKl0vN7petfzZgqIhlc2NP9KQ4OIDsR/ta4Cqq6o=; b=OAk8uasP6uk/3To89/YuZWMmbGbt7Yu0tyinUSOn2ZSJGTo9nVvWgggH0iQAic/w5Y NeHdhEY/xdCxWGxXc9gxReG4OEM6IeYpejmHurd0vanuH8+qlu130XS71/xO0cBYXUhV Qwb2yn9xSLC7jy1TYhs0iql1e7lGWmHhzNgtfFlCQwzY700Nui/ZpRr+RZAjXTGdVlue 0rsIEGPgVcj5PVduDtonBYRZ5YpFLUjhCpHXUpyCWVEy5URxWa7oo76oV3Z9yZeC6yZA Uqs15WEwT948RH7nQueoVM7HPfEU8nYFMpSC4hgg4KmAQn4Vd0JehGn+QyEcOS/x7tAi ynhQ== X-Forwarded-Encrypted: i=1; AKwUvBzMMOtyR92gTpKBPxSIgB7AHj3yguHcg/IMyIyx6nAGQ4gy8vJRStTs6QpZ3AnpTU0E4ABuf1DQX0esr1g=@vger.kernel.org X-Gm-Message-State: AFuF++nkxFSGxF5Xc9WsbTMkZzkaUDsAiAAmC8hKNuZiiVQ0sEyJMEpi 4YDWnJCwST6EHLbwOltl9ym+GI5OXLOghDH5kk7Y3owSRpXfJ1Y+Kv0XqKz1HBmj1eYLCtbCO6V lJeG+vEA68Q== X-Gm-Gg: AYBFou35meDaU0ss2GCfI/vd7vJhiqXzZjdIFwz2qTMmII/AwWVch9HGax/B7LeAvpA Le3Xg5LtxfEntG9MJ2c3nnJB9VTwq/auGBwMx3aVMg+v0/retx+m/s+H+xkYJH/DSbKecaXGiCp 4gygrxkrYVYKoNkLE6+4i+waZg8T+ByCcVSc4lDkdzK6Q63/g1N9ryt+CsFn9U7m46IRY01EwLd qIr71m/SnikSuH8B++0kN/oNJr1qJ3uCVQbMa/W8AaPsNVuV5VgtmCEpQugn68gui3Xtk8JVtVq XGkgeUbod9Zwlt5wpxZvl05w+obvU7Z3Tbxc2YSTJC1Xm/+jb4vKP5WkiGxKVXyryrZ8z0XbweW xITu++a/Yg5UGGa6NtBWPfu1aL+zXaSwKWOpd5nEWDP413W3N00hlsQRYjl5dMDDW8Mze6kUFkl yQhitru2fkODgjCahjrnG+szkKOuv/765nX/E9FnfFMDjlJRwBCo5RHqifAT/sVWKWVtvuPhyLn tbaYEwxjl9ACveBBqRGFex7UA== X-Received: by 2002:a05:622a:e113:20b0:535:8607:d2e2 with SMTP id d75a77b69052e-5358607f4bamr14319421cf.56.1791396994064; Wed, 07 Oct 2026 11:16:34 -0700 (PDT) Received: from toxicpanda.com ([153.61.196.250]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-53572163ceesm25476671cf.20.2026.10.07.11.16.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 07 Oct 2026 11:16:33 -0700 (PDT) From: Josef Bacik Date: Wed, 07 Oct 2026 18:16:14 +0000 Subject: [PATCH net-next 1/9] net: ftmac100: check for failure when pulling in the RX header Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261007-b4-pskb-pull-tail-drivers-v1-1-9512b0fb977b@toxicpanda.com> References: <20261007-b4-pskb-pull-tail-drivers-v1-0-9512b0fb977b@toxicpanda.com> In-Reply-To: <20261007-b4-pskb-pull-tail-drivers-v1-0-9512b0fb977b@toxicpanda.com> To: Jakub Kicinski , Paolo Abeni , Eric Dumazet , "David S. Miller" , Andrew Lunn Cc: Saeed Mahameed , Tariq Toukan , Mark Bloch , Leon Romanovsky , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , Tony Nguyen , Przemek Kitszel , Manish Chopra , Rahul Verma , GR-Linux-NIC-Dev@marvell.com, Shahed Shaikh , Simon Horman , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org, xen-devel@lists.xenproject.org, intel-wired-lan@lists.osuosl.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1791396985; l=1745; i=josef@toxicpanda.com; h=from:subject:message-id; bh=YaVSidg1Bo1cVWoGQJzV4z/nBT+SLxbK+9NmCYkL+oY=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QLi6NM2cH1GaCjQ09bIeFY42DV/aexWSzx1/i1cHNG8H1PuIyQKikelvwnWe7Tmx+A2sBSVuNWU /fPwJUm49cAs= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA ftmac100_rx_packet() uses __pskb_pull_tail() to pull either the Ethernet header or, for small frames, the whole frame into the skb head, and ignores the return value. If that pull ever failed, eth_type_trans() would find less than ETH_HLEN in the head and BUG() in __skb_pull(). It doesn't fail today because the skb is freshly allocated, isn't shared and has room in the head, but that's only true because of how this driver allocates. Use pskb_may_pull() for the header and __skb_linearize() for small frames, which is what the two pulls are doing, and drop the frame if either fails. Assisted-by: LLM Signed-off-by: Josef Bacik --- drivers/net/ethernet/faraday/ftmac100.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c index 40ba001d4b3f..a1eb04ead2d8 100644 --- a/drivers/net/ethernet/faraday/ftmac100.c +++ b/drivers/net/ethernet/faraday/ftmac100.c @@ -469,15 +469,21 @@ static bool ftmac100_rx_packet(struct ftmac100 *priv, int *processed) if (length > 128) { skb->truesize += PAGE_SIZE; /* We pull the minimum amount into linear part */ - __pskb_pull_tail(skb, ETH_HLEN); + ret = pskb_may_pull(skb, ETH_HLEN); } else { /* Small frames are copied into linear part to free one page */ - __pskb_pull_tail(skb, length); + ret = !__skb_linearize(skb); } ftmac100_alloc_rx_page(priv, rxdes, GFP_ATOMIC); ftmac100_rx_pointer_advance(priv); + if (unlikely(!ret)) { + netdev->stats.rx_dropped++; + kfree_skb(skb); + return true; + } + skb->protocol = eth_type_trans(skb, netdev); netdev->stats.rx_packets++; -- 2.55.0