On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, skb->mac_header
is left unset when ndo_start_xmit() runs, so eth_hdr(skb) resolves ~64KB out of
bounds. Commit f5089008f90c ("macsec: don't read an unset MAC header in
macsec_encrypt()") fixed one instance; these three are the same class in other
TX/.xmit paths, each reading eth_hdr(skb)->h_dest. On TX the L2 header is at
skb->data, so use skb_eth_hdr() (a no-op on normal TX where mac_header is set).Found by static analysis (0sec); verified against source, not runtime-reproduced. Confirmed by an independent cross-check that mac_header is unset on the bypass path (__dev_direct_xmit does not reset it). More siblings exist (sja1105 shared TX/RX helper, atlantic PTP path) and will follow separately. Doruk Tan Ozturk (3): net: dsa: tag_ocelot_8021q: don't read an unset MAC header on transmit net: dsa: tag_ksz: don't read an unset MAC header in lan937x_xmit() ibmveth: don't read an unset MAC header on transmit drivers/net/ethernet/ibm/ibmveth.c | 2 +- net/dsa/tag_ksz.c | 2 +- net/dsa/tag_ocelot_8021q.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) -- 2.43.0
