Commit 093a28998374 for kernel

commit 093a28998374f4007ffe67cc661f8192c1b062a9
Author: Eric Dumazet <edumazet@kernel.org>
Date:   Wed Oct 28 13:27:00 2026 +0100

    loopback: use eth_type_trans_careful()

    tc egress actions can leave an skb with fewer than ETH_HLEN bytes in
    its linear part. loopback_xmit() then crashes in eth_type_trans():

      tc qdisc add dev lo clsact
      tc filter add dev lo egress matchall action vlan pop_eth
      # AF_PACKET SOCK_RAW: eth / eth / 8192 bytes of payload

      kernel BUG at include/linux/skbuff.h:2839!
      RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163)
      Call Trace:
       loopback_xmit (drivers/net/loopback.c:87)
       dev_hard_start_xmit (include/linux/netdevice.h:5455 include/linux/netdevice.h:5464 net/core/dev.c:4057 net/core/dev.c:4073)
       __dev_queue_xmit (net/core/dev.c:5066)
       packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)

    The same happens with "action ife decode" on lo egress.

    Use eth_type_trans_careful(), and drop the packet if the Ethernet
    header can not be pulled.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Reported-by: Vega <vega@nebusec.ai>
    Link: https://lore.kernel.org/netdev/20261005052249.1914367-2-weir@nebusec.ai/
    Signed-off-by: Eric Dumazet <edumazet@kernel.org>
    Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Tested-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Acked-by: Alexei Starovoitov <ast@kernel.org>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Link: https://patch.msgid.link/20261028122703.2093730-3-edumazet@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 55ecd5ebac0f..8a6cb34e6b5f 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -70,6 +70,7 @@ EXPORT_SYMBOL(blackhole_netdev);
 static netdev_tx_t loopback_xmit(struct sk_buff *skb,
 				 struct net_device *dev)
 {
+	enum skb_drop_reason reason;
 	int len;

 	skb_tx_timestamp(skb);
@@ -84,7 +85,12 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
 	 */
 	skb_dst_force(skb);

-	skb->protocol = eth_type_trans(skb, dev);
+	reason = eth_type_trans_careful(skb, dev);
+	if (unlikely(reason)) {
+		dev_core_stats_tx_dropped_inc(dev);
+		kfree_skb_reason(skb, reason);
+		return NETDEV_TX_OK;
+	}

 	len = skb->len;
 	if (likely(__netif_rx(skb) == NET_RX_SUCCESS))