Subject: BUG: KASAN: slab-out-of-bounds in ice_start_xmit+0x57cc/0x5ef0 [ice]

From: Thomas Bogendoerfer <[email-masked]>
Date: Thu, 30 Apr 2026 12:17:15 +0200

While working on another ice issue, I've noticed a KASAN splat, when using
xskxceiver test program. This is caused by

        eth = (struct ethhdr *)skb_mac_header(skb);
...
	                           eth->h_proto == htons(ETH_P_LLDP)) &&

in ice_xmit_frame_ring().

It would be easy to check for the unset mac_header condition in ice
driver (there are other drivers using skb_mac_header() in .ndo_start_xmit).
But since __dev_queue_xmit() is doing a skb_reset_mac_header(), shouldn't
__dev_direct_xmit() do the same ?

Thomas.

-- 
SUSE Software Solutions Germany GmbH__dev_queue_xmit
HRB 36809 (AG Nürnberg)
Geschäftsführer: Jochen Jaser, Andrew McDonald, Werner Knoblich