From nobody Fri Sep 25 04:09:00 2026 Received: from mail-pz2-f43.google.com (mail-pz2-f43.google.com [74.125.228.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 950BF364044 for ; Wed, 16 Sep 2026 21:38:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.228.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789594706; cv=none; b=kyCzcF812T3Oo+7jhj3tc0XBxaOEImS2EeAx2oXNUiCCK8TjYETW4i4JLaotyO1fa4htBTtmZNTQFD9i5aIo3e21dS+eC62WpqEiPmJdmboz2PstDJzmsJFmYWLnU9ju3TAU3lUmz7+206JNMVDk0wBBMvAQ4+fM3zTMB5wUn6U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789594706; c=relaxed/simple; bh=uNlx2hpfeoxZRCqrhu5DYCSMd8YIQavLzVraY8D2lTM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=Yup+zjPSt33PntKOVtyRSLParG1Kdg4eQpMsAGUTuti0Mll90PKlXWgfrkp7ubreKekMTxFPq5XSC4kKZ3e3lQvbAW6bfmQgKrJ6ecevrqSyDAoo6FiqJo1Q20JmVk+2vhccUuDXlzkXbYevwsilV4s06nJzvo+RUXEDLrJJYuQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mj0kr8u5; arc=none smtp.client-ip=74.125.228.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mj0kr8u5" Received: by mail-pz2-f43.google.com with SMTP id d2e1a72fcca58-8623e5d435cso45338b3a.1 for ; Wed, 16 Sep 2026 14:38:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789594699; x=1790199499; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=njMIgBpCOlJ4XFoV/IxBhtjHnwV8oWctBsfBYWR97cs=; b=mj0kr8u5nIcAGY5nkxZEouP3xp80gEeNBe9aVeDIhTFcv+6BHMLFauDmdUQ3idyWq2 07UJNqlgiVwWCqmkGNXq1fdvXDjbfH8l6h9oeVPX+eCTw9FusWT+x6GBCIVeIfoWiZcG nqKs1j58WLOOPrAdsl6DYtacENy+Onti+o9ahmHvEeqJvRTrR8N1KjgcCCp4PieX+cka v9P5moaGEUThjY7G/MGZul7T145Z5P9PO8SwrYNp/mbgUckmqkRj7fTngk1oao/qPRqS 33k7FhK4c2lM2RivQlwT6F7oVoUi0VA8ANkJJ4qk/Zc2j68qrRuzTo/8FPbHzQL+fVya vD8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789594699; x=1790199499; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=njMIgBpCOlJ4XFoV/IxBhtjHnwV8oWctBsfBYWR97cs=; b=EgRqLctE389Z1HNOeahDB6y1UcBbQW6nP9mmrQHizGxdlmacyaZvWDh+c9pcb+QMe9 vZDu7s3nHbFpPhEWwRC8tcJG3MzeHo8r6Stv20X9RLTN/jv9WaFVayKDlv0OKJV81t0a jTmM616lSB34XV+lLP+rFyRa25C5h9HYDY5bFqhPatHvPn9bJYFkA+bhO6uzbkJ8JxUz RV8E9lwGVIeELh7En91bjIzYE8cEkiBu716D9ldZhhr9PITdKhDm/w8Egy9xrTm9ds4u 7/51mS+s3jo8RpzZUEEniSSBC4CuqMQxBq2Hd+gxGn4sQpgNG6biI8I4WM1fky5cZ0wX BQTg== X-Forwarded-Encrypted: i=1; AKwUvBz0n+QNTWxg0SwK8d/OdZ6jMIo0nKCEhstjU1UTi9tnD8wsl7wqt9SqblIAN59lNIqPOyYD0mFrk/vQCAg=@vger.kernel.org X-Gm-Message-State: AFuF++mAr+32omeSe6h8gzpXkoAzxK/gZAlV2iOG7MofJbmSkuVUuT4M AqQhErcGDa+tqS8sqduP8tqMxHE869iUOrjkK6uSFZX4K1uiXEzFjKYD X-Gm-Gg: AYBFou3Wtyd0BYCTMTUcXMmhTeCEf5gb73lFde2Pe7FIVPluVDAv/EWNndQkyKyJ7Gr b3uEXOGyN/grDHMN0emOATngzuwRsKJglR6Cz0tFW62vtt060/fffQuqBoqTRV/wYwyikX7vmGm 3qn3kIJnk2Kw++t8Sz0hpumeTIHd9R7ul1AVXNZ2J6p1vH1PXvlNnfHdr+/H2o536JN55anW43+ Ogos06qiR0efxpW9NlC/SViFSp26fmj89V4xTDjp7kc1kvX90GVwdDCYkcqK1ZfxTMxfqsh3HWB NkbFq9ARdE8cvfXYQPwBsEbN24pBOrZgHBtPYL0Gh2Yp5Uzzhdk9bvV8IW8w5Z+0bsYbwr6PiOj 9lh+98b42UTBzRAMkB//o++Hhuo9ryamn3b73wJKtMrN83T3N7nHOZHIf9ZxankXkt5xW/IEeWG SSQ64JyfhK+c0/1166JSTNAlA5vOCcfezGVfKiCO98aNZHPdC8zssUHnnvwYPRREgpYdiajnObj +4BUgjOlQ== X-Received: by 2002:a05:6a00:21d6:b0:84e:cd14:aeba with SMTP id d2e1a72fcca58-873435a52e4mr1403570b3a.6.1789594699152; Wed, 16 Sep 2026 14:38:19 -0700 (PDT) Received: from [163.43.103.131] ([163.43.103.131]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8720173842csm1830615b3a.41.2026.09.16.14.38.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 16 Sep 2026 14:38:18 -0700 (PDT) From: Yuya Kusakabe Date: Thu, 17 Sep 2026 06:38:16 +0900 Subject: [PATCH net] seg6: keep room for the mac header when growing the headroom Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260917-seg6-maclen-headroom-v1-1-02ccec50f096@gmail.com> X-B4-Tracking: v=1; b=H4sIAEcMq2oC/yWM0QqDMAwAf0XyvIC1THG/MvaQpZlmzHY0OgTx3 +22xzu428Akqxhcqg2yfNQ0xQLuVAGPFAdBDYWhqZu27l2HJkOLE/FLIo5CIac04dmT9z27LhB DSd9ZHrr+tleIMsPtL225P4Xn7xD2/QCdNXimfQAAAA== X-Change-ID: 20260917-seg6-maclen-headroom-53a339c17dac To: Andrea Mayer , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Justin Iurman Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Yuya Kusakabe X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=2816; i=yuya.kusakabe@gmail.com; h=from:subject:message-id; bh=uNlx2hpfeoxZRCqrhu5DYCSMd8YIQavLzVraY8D2lTM=; b=owEBbQKS/ZANAwAIASrX0XUqXRtNAcsmYgBqqwxIMgHFbdimLQQJXT6/bd4d8vpzcsOlWPi8G HuUoqGnYOGJAjMEAAEIAB0WIQTaB7usAfxNKMeqa6Yq19F1Kl0bTQUCaqsMSAAKCRAq19F1Kl0b TVHCEACZ9/UU3vbviZElkjvyFmQTHOERAOE/Q9pCAx7PtLa2zcyl4KtncBvLyZLNFL91mjVGS4X UuZQkxVcsxZ4KYZh5sCqYWSrs9/j9MjuMAiAWNcYdi2gJEIO9E02P5098MiM+7RnL66jGmUjxCj OxEciSNiawABlBH8S4iGyX1UVLPb/CEgHGBdajGIXDNRml3o+jXu4ETBuahtDFFStFz84T55Y8a 6igo9Mf0xN74Opk7uw2WvQsC3dZdA0UEsgjCzh9u8D77O/YB/7PLgdEiHlAkF07qrBbMuijAHUE eybsL9IrCdGQIFKwUJPD1idCi+kdd1xhHKqnrRh1vnaubjydWaw6snYQTlLk4aJepPCS6SjorZG DKUEkW4Sp+Ssne88fhU19yy7m1qGVTtxCJdI9U6sUffBsQ5+1Ht6yOeeJpY3h9xqDILFvwjqI75 sPjcrhFD0Er+jZNGIGS5sUG/aUov6MHJY26aBNE6heavfk+fe8j4iQv5WJRF+nlwywRyb4zMhq9 8Rx+q6nnbNvgfPqabncqKSLGqdtXHny9C/YrEXvex2NKuzB3RHrwTUJeRWetHdAKwJc7CLR6oAb 2a5NhbXgQYGpKr03D4vrW7oZB5fY5vYro1QNPPKX5EB7VC0Age9eYqPq7JGPbuvhkC99KWGcYwz 8+f87cxDWeGHzTw== X-Developer-Key: i=yuya.kusakabe@gmail.com; a=openpgp; fpr=DA07BBAC01FC4D28C7AA6BA62AD7D1752A5D1B4D __seg6_do_srh_inline(), __seg6_do_srh_encap() and seg6_do_srh_encap_red() all grow the headroom with skb_cow_head(), push the new headers into it, and then rebuild the mac header below them with skb_mac_header_rebuild(). The headroom left after the push has to be at least skb->mac_len for that rebuild, but the three requests ask for the pushed length plus dst_dev_overhead(), which leaves LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet. Where the mac header is longer than that, as it is on ingress through a VLAN device with reorder_hdr off, the rebuild runs out of room: skb_set_mac_header(skb, -skb->mac_len) computes a negative offset, stores it unchecked in the u16 skb->mac_header, and the memmove that follows writes skb->mac_len bytes about 64 KB past skb->head. Forwarding plain ping6 traffic through such a device reproduces it on all five encapsulation modes; skb->mac_header comes back as 65534 on a 704-byte head. Ask for whichever of the two is larger. These requests carried skb->mac_len until the egress overhead took its place rather than joining it. Fixes: 40475b63761a ("net: ipv6: seg6_iptunnel: mitigate 2-realloc issue") Assisted-by: LLM Signed-off-by: Yuya Kusakabe Reviewed-by: Justin Iurman --- net/ipv6/seg6_iptunnel.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c index 61c6a27bf202..0e60bbca19ca 100644 --- a/net/ipv6/seg6_iptunnel.c +++ b/net/ipv6/seg6_iptunnel.c @@ -153,7 +153,8 @@ static int __seg6_do_srh_encap(struct sk_buff *skb, str= uct ipv6_sr_hdr *osrh, hdrlen =3D (osrh->hdrlen + 1) << 3; tot_len =3D hdrlen + sizeof(*hdr); =20 - err =3D skb_cow_head(skb, tot_len + dst_dev_overhead(cache_dst, skb)); + err =3D skb_cow_head(skb, tot_len + max(skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; =20 @@ -255,7 +256,8 @@ static int seg6_do_srh_encap_red(struct sk_buff *skb, =20 tot_len =3D red_hdrlen + sizeof(struct ipv6hdr); =20 - err =3D skb_cow_head(skb, tot_len + dst_dev_overhead(cache_dst, skb)); + err =3D skb_cow_head(skb, tot_len + max(skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; =20 @@ -351,7 +353,8 @@ static int __seg6_do_srh_inline(struct sk_buff *skb, st= ruct ipv6_sr_hdr *osrh, =20 hdrlen =3D (osrh->hdrlen + 1) << 3; =20 - err =3D skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb)); + err =3D skb_cow_head(skb, hdrlen + max(skb->mac_len, + dst_dev_overhead(cache_dst, skb))); if (unlikely(err)) return err; =20 --- base-commit: 9a1599eeb8d18a2113e4cabcbd3bec5a8377dbed change-id: 20260917-seg6-maclen-headroom-53a339c17dac Best regards, -- =20 Yuya Kusakabe