From: Jakub Kicinski <kuba@kernel.org>
To: Chen Zhen <chenzhen126@huawei.com>
Cc: <davem@davemloft.net>, <edumazet@google.com>, <pabeni@redhat.com>,
<horms@kernel.org>, <netdev@vger.kernel.org>,
<linux-kernel@vger.kernel.org>, <huyizhen2@huawei.com>,
<gaoxingwang1@huawei.com>
Subject: Re: [PATCH net] net: vlan: set header_ops to match hard_header_len when hw offload is toggled
Date: Mon, 5 Jan 2026 16:22:43 -0800 [thread overview]
Message-ID: <20260105162243.59e72816@kernel.org> (raw)
In-Reply-To: <20251231035419.23422-1-chenzhen126@huawei.com>
On Wed, 31 Dec 2025 11:54:19 +0800 Chen Zhen wrote:
> skbuff: skb_under_panic: text:ffffffff95b33e66 len:90 put:14 head:ffff915ac1967440 data:ffff915ac196743e tail:0x58 end:0x180 dev:br0.10
> ------------[ cut here ]------------
> kernel BUG at net/core/skbuff.c:197!
> Call Trace:
> <TASK>
> skb_push+0x39/0x40
> eth_header+0x26/0xb0
> vlan_dev_hard_header+0x58/0x130 [8021q]
> neigh_connected_output+0xae/0x100
> ip6_finish_output2+0x2cc/0x650
> ? nf_hook_slow+0x41/0xc0
> ip6_finish_output+0x27/0xd0
> ndisc_send_skb+0x1d0/0x370
> ? __pfx_dst_output+0x10/0x10
> ndisc_send_ns+0x5a/0xb0
> addrconf_dad_work+0x2b5/0x380
> process_one_work+0x17f/0x320
Please run this stack trace thru script/decode_stacktrace
and you can cut off here, no need to include functions
below process_one_work, they are irrelevant.
> worker_thread+0x26d/0x2f0
> ? __pfx_worker_thread+0x10/0x10
> kthread+0xcc/0x100
> ? __pfx_kthread+0x10/0x10
> ret_from_fork+0x30/0x50
> ? __pfx_kthread+0x10/0x10
> ret_from_fork_asm+0x1b/0x30
> </TASK>
>
> This bug can be easily reproduced by these steps:
>
> ip link add veth0 type veth peer name veth1
> ip link set veth0 up
> ip link set veth1 up
> ethtool -K veth0 tx-vlan-hw-insert off
> # vlandev.header_ops = vlan_header_ops, hard_header_len = 18(hard_header_len + VLAN_HLEN)
> ip link add link veth0 name veth0.10 type vlan id 10 reorder_hdr off
> ip addr add 192.168.10.1/24 dev veth0.10
> ip link set veth0.10 up
> # vlandev.hard_header_len = 14(hard_header_len)
> ethtool -K veth0 tx-vlan-hw-insert on
> # Panic!
Instead of putting this in the commit message please add a selftest
which will automatically catch re-occurrence of the issue.
> The reason is that when NETIF_F_HW_VLAN_CTAG_TX is off, vlandev.hard_header_len will be set to
> dev->hard_header_len since commit 029f5fc31cdb ("8021q: set hard_header_len when VLAN offload features
> are toggled"), but the header_ops remains unchanged. Then neigh_connected_output() will call
> vlan_dev_hard_header() and panic in skb_push() because reorder_hdr is off.
Please wrap commit messages at 70 columns.
--
pw-bot: cr
next prev parent reply other threads:[~2026-01-06 0:22 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-31 3:54 [PATCH net] net: vlan: set header_ops to match hard_header_len when hw offload is toggled Chen Zhen
2026-01-06 0:22 ` Jakub Kicinski [this message]
2026-01-06 2:04 ` Chen Zhen
-- strict thread matches above, loose matches on Subject: below --
2025-12-31 3:50 c00642392
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260105162243.59e72816@kernel.org \
--to=kuba@kernel.org \
--cc=chenzhen126@huawei.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=gaoxingwang1@huawei.com \
--cc=horms@kernel.org \
--cc=huyizhen2@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.