Commit 498c631f9c6d for kernel

commit 498c631f9c6d74aad4bf43039fa3ce70ae9a8bb7
Author: Jamal Hadi Salim <jhs@mojatatu.com>
Date:   Wed Oct 28 13:27:03 2026 +0100

    net/sched: act_ife: do not consume the inner header on egress

    The issue:
    tcf_ife_decode() unconditionally calls eth_type_trans(), which pulls
    ETH_HLEN.  On egress this consumes the inner Ethernet header, and the
    device receives an skb whose data points to the L3 header:

    - loopback_xmit() parses L3 data as Ethernet: the "ethertype" comes
      from the inner IPv4 source address, and the decapsulated packet is
      dropped or misparsed.
    - a real NIC transmits the frame without its Ethernet header.

    (The __skb_pull() BUG this used to trigger in loopback_xmit() when the
    remaining linear area was short is handled by "loopback: use
    eth_type_trans_careful()".)

    The Fix:
    Parse the inner Ethernet header with eth_type_trans() in both directions,
    then restore the egress data position and MAC length.  On ingress the
    existing behavior is unchanged.  On egress, push the inner Ethernet header
    back after parsing so the xmit path sees the original frame and later
    actions see a consistent network header.

    Conditions to recreate the bug:
    - egress tc filter on lo: action ife decode pipe;
    - AF_PACKET SOCK_RAW frame: outer Ethernet with ETH_P_IFE, IFE metadata,
      inner Ethernet + a valid IPv4 ICMP echo request to a local address;
    - before this patch, no echo is received; after it, the echo is
      delivered and answered.

    Fixes: ef6980b6becb ("introduce IFE action")
    Cc: stable@vger.kernel.org
    Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
    [edumazet: reworded changelog, the crash is now handled in loopback]
    Signed-off-by: Eric Dumazet <edumazet@kernel.org>
    Acked-by: Alexei Starovoitov <ast@kernel.org>
    Link: https://patch.msgid.link/20261028122703.2093730-6-edumazet@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 2afd68983ece..3946a9589bb8 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -769,6 +769,10 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,

 	skb->protocol = eth_type_trans(skb, skb->dev);
 	skb_reset_network_header(skb);
+	if (!skb_at_tc_ingress(skb)) {
+		skb_push(skb, ETH_HLEN);
+		skb_reset_mac_len(skb);
+	}

 	return action;
 }