Commit b55e5a0159c8 for kernel

commit b55e5a0159c8f53edefcb7848d95eb93db37bce1
Author: Eric Dumazet <edumazet@kernel.org>
Date:   Wed Oct 28 13:27:02 2026 +0100

    openvswitch: use eth_type_trans_careful() in internal_dev_recv()

    OVS actions like pop_eth followed by pop_mpls(ETH_P_TEB) or pop_nsh
    can expose an inner Ethernet header which is not in the linear part
    of the skb. Output to an internal port then crashes in eth_type_trans():

      flow: in_port(0),eth(),eth_type(0x8847),mpls(lse=0x00010140)
      actions: pop_eth,pop_mpls(0x6558),0
      # AF_PACKET SOCK_RAW on dp0: eth / mpls / eth / 4096 bytes of payload

      kernel BUG at include/linux/skbuff.h:2839!
      RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163)
      Call Trace:
       internal_dev_recv (net/openvswitch/vport-internal_dev.c:202) openvswitch
       do_execute_actions (net/openvswitch/actions.c:1296) openvswitch
       ovs_execute_actions (net/openvswitch/actions.c:1606) openvswitch
       ovs_dp_process_packet (net/openvswitch/datapath.c:310) openvswitch
       ovs_vport_receive (net/openvswitch/vport.c:448) openvswitch
       internal_dev_xmit (net/openvswitch/vport-internal_dev.c:42) openvswitch
       dev_hard_start_xmit (include/linux/netdevice.h:5455 include/linux/netdevice.h:5464 net/core/dev.c:4057 net/core/dev.c:4073)
       __dev_queue_xmit (net/core/dev.c:5066)
       packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)

    Use eth_type_trans_careful(), and drop the packet if the Ethernet
    header can not be pulled. This covers all OVS actions at the consumer,
    instead of fixing each producer.

    Fixes: b2d0f5d5dc53 ("openvswitch: enable NSH support")
    Fixes: f66b53fdbb22 ("openvswitch: New MPLS actions for layer 2 tunnelling")
    Signed-off-by: Eric Dumazet <edumazet@kernel.org>
    Reviewed-by: Aaron Conole <aconole@redhat.com>
    Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Tested-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Acked-by: Alexei Starovoitov <ast@kernel.org>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Link: https://patch.msgid.link/20261028122703.2093730-5-edumazet@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 77a16d5ebd54..8f035087f0ee 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -188,6 +188,7 @@ static void internal_dev_destroy(struct vport *vport)
 static int internal_dev_recv(struct sk_buff *skb)
 {
 	struct net_device *netdev = skb->dev;
+	enum skb_drop_reason reason;

 	if (unlikely(!(netdev->flags & IFF_UP))) {
 		kfree_skb(skb);
@@ -199,7 +200,12 @@ static int internal_dev_recv(struct sk_buff *skb)
 	nf_reset_ct(skb);

 	skb->pkt_type = PACKET_HOST;
-	skb->protocol = eth_type_trans(skb, netdev);
+	reason = eth_type_trans_careful(skb, netdev);
+	if (unlikely(reason)) {
+		dev_core_stats_rx_dropped_inc(netdev);
+		kfree_skb_reason(skb, reason);
+		return NETDEV_TX_OK;
+	}
 	skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
 	dev_sw_netstats_rx_add(netdev, skb->len);