Ensure the skb has enough headroom for the hardware offload device's
hard_header_len. If the headroom is insufficient (e.g., when routing
through certain virtual or tunnel devices), __skb_push() underflows
skb->data below skb->head, causing silent memory corruption.

Fix this by using skb_cow_head() to dynamically expand headroom if
needed, and switch to the checked skb_push() variant.

Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")

Signed-off-by: Günther Muller <gunther.muller2008@gmail.com>
---
 net/xfrm/xfrm_output.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index cc35c2fcbb..35f974d209 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -649,7 +649,10 @@ static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x,
 	 * to netdevice.
 	 */
 	skb->dev = x->xso.dev;
-	__skb_push(skb, skb->dev->hard_header_len);
+	err = skb_cow_head(skb, skb->dev->hard_header_len);
+	if (err)
+		return err;
+	skb_push(skb, skb->dev->hard_header_len);
 	return dev_queue_xmit(skb);
 }
 
-- 
2.39.5

On Mon, May 18, 2026 at 10:04:09AM +0200, Günther Muller wrote:
> Ensure the skb has enough headroom for the hardware offload device's
> hard_header_len. If the headroom is insufficient (e.g., when routing
> through certain virtual or tunnel devices), __skb_push() underflows
> skb->data below skb->head, causing silent memory corruption.
> 
> Fix this by using skb_cow_head() to dynamically expand headroom if
> needed, and switch to the checked skb_push() variant.
> 
> Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
> 
> Signed-off-by: Günther Muller <gunther.muller2008@gmail.com>
> ---
>  net/xfrm/xfrm_output.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
> index cc35c2fcbb..35f974d209 100644
> --- a/net/xfrm/xfrm_output.c
> +++ b/net/xfrm/xfrm_output.c
> @@ -649,7 +649,10 @@ static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x,
>  	 * to netdevice.
>  	 */
>  	skb->dev = x->xso.dev;
> -	__skb_push(skb, skb->dev->hard_header_len);
> +	err = skb_cow_head(skb, skb->dev->hard_header_len);
> +	if (err)
> +		return err;

You leak skb here. Also, we should bump a statistic counter
when droping the packet.

On Mon, May 18, 2026 at 10:04:09AM +0200, Günther Muller wrote:
> Ensure the skb has enough headroom for the hardware offload device's
> hard_header_len. If the headroom is insufficient (e.g., when routing
> through certain virtual or tunnel devices), __skb_push() underflows
> skb->data below skb->head, causing silent memory corruption.

Could you please provide the steps required to reproduce the issue?

> 
> Fix this by using skb_cow_head() to dynamically expand headroom if
> needed, and switch to the checked skb_push() variant.
> 
> Fixes: 5eddd76ec2fd ("xfrm: fix tunnel mode TX datapath in packet offload mode")
> 

Extra blank line.

> Signed-off-by: Günther Muller <gunther.muller2008@gmail.com>
> ---
>  net/xfrm/xfrm_output.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
> index cc35c2fcbb..35f974d209 100644
> --- a/net/xfrm/xfrm_output.c
> +++ b/net/xfrm/xfrm_output.c
> @@ -649,7 +649,10 @@ static int xfrm_dev_direct_output(struct sock *sk, struct xfrm_state *x,
>  	 * to netdevice.
>  	 */
>  	skb->dev = x->xso.dev;
> -	__skb_push(skb, skb->dev->hard_header_len);
> +	err = skb_cow_head(skb, skb->dev->hard_header_len);
> +	if (err)
> +		return err;
> +	skb_push(skb, skb->dev->hard_header_len);
>  	return dev_queue_xmit(skb);
>  }
>  
> -- 
> 2.39.5
> 
> 

On Mon, May 18, 2026 at 03:30:54PM +0300, Leon Romanovsky wrote:
> On Mon, May 18, 2026 at 10:04:09AM +0200, Günther Muller wrote:
> > Ensure the skb has enough headroom for the hardware offload device's
> > hard_header_len. If the headroom is insufficient (e.g., when routing
> > through certain virtual or tunnel devices), __skb_push() underflows
> > skb->data below skb->head, causing silent memory corruption.
> 
> Could you please provide the steps required to reproduce the issue?

Please answer Leons question.

Thanks!