Linux skb packet count header and metadata

Question

Could not find any info about this header at the end of Skb and about this metadata

So it seems it is user controlled and should be checked for bounds

static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
{
    struct sk_buff *ax_skb;
    int pkt_cnt;
    u32 rx_hdr;
    u16 hdr_off;
    u32 *pkt_hdr;

    /* At the end of the SKB, there's a header telling us how many packets
     * are bundled into this buffer and where we can find an array of
     * per-packet metadata (which contains elements encoded into u16).
     */
    if (skb->len < 4)
        return 0;
    skb_trim(skb, skb->len - 4);
    rx_hdr = get_unaligned_le32(skb_tail_pointer(skb));
    pkt_cnt = (u16)rx_hdr;
    hdr_off = (u16)(rx_hdr >> 16);

    if (pkt_cnt == 0)
        return 0;

    /* Make sure that the bounds of the metadata array are inside the SKB
     * (and in front of the counter at the end).
     */
    if (pkt_cnt * 2 + hdr_off > skb->len)
        return 0;

Can somebody point to code in Kernel or references describing it?

Answer 1

USB Ethernet devices don't have hardware framing support, so have their own schemes to do framing by inserting extra bytes in the packet. The tx_fixup and rx_fixup are provided to do that. Some of the schemes are described here: http://www.linux-usb.org/usbnet