Re: [PATCH net] net/packet: call packet_parse_headers after virtio_net_hdr_to_skb

["Michael S. Tsirkin" <mst@redhat.com>]

On Wed, Oct 07, 2026 at 01:57:30PM -0400, Willem de Bruijn wrote:
> From: Willem de Bruijn <willemb@google.com>
> 
> SOCK_RAW packet sockets incorrectly drop VLAN-tagged GSO packets
> without VIRTIO_NET_HDR_F_NEEDS_CSUM.
> 
> packet_parse_headers() sets skb->protocol to VLAN but advances
> skb->network_header past the VLAN tags. virtio_net_hdr_to_skb()
> then flow dissects these packets, which parses the network header as a
> VLAN tag, and fails.
> 
> Call packet_parse_headers() after virtio_net_hdr_to_skb() instead.
> 
> This matches tun_get_user() and tap_get_user() and thus simplifies
> overall complexity.
> 
> Commit 01fdecc0480d ("net: packet: fix wrong transport_header when
> sending VLAN-tagged frame") fixed the same issue for the transport
> header probe in packet_parse_headers(). That probe is now skipped if
> virtio_net_hdr_to_skb() already set the transport header, avoiding a
> redundant dissection.
> 
> Implementation details:
> - Do not set skb->protocol to the RX wildcard ETH_P_ALL. SOCK_RAW then
>   derives it from the link layer header, as before. SOCK_DGRAM now
>   leaves it 0, or derives it from gso_type for GSO with NEEDS_CSUM.
> - Keep virtio_net_hdr_set_proto() last, so that the link layer protocol
>   takes priority over gso_type.
> 
> Reported-by: Junnan Zhang <zhangjn_dev@163.com>
> Closes: https://lore.kernel.org/netdev/20260821085722.24036-1-zhangjn_dev@163.com/
> Fixes: dfed913e8b55 ("net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO")
> Signed-off-by: Willem de Bruijn <willemb@google.com>


Acked-by: Michael S. Tsirkin <mst@redhat.com>

> ---
> 
> This was discovered through the report linked in the Closes: tag.
> 
> Also independently reported by LLM code reviews as pre-existing issue,
> and verified with a reproducer.
> ---
>  net/packet/af_packet.c | 25 +++++++++++++++----------
>  1 file changed, 15 insertions(+), 10 deletions(-)
> 
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index 6ff16eef24f4..52ae3d875e97 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -1943,8 +1943,7 @@ static void packet_parse_headers(struct sk_buff *skb, struct socket *sock)
>  	/* On TX skb->data is the L2 header; anchor it for all socket types. */
>  	skb_reset_mac_header(skb);
>  
> -	if ((!skb->protocol || skb->protocol == htons(ETH_P_ALL)) &&
> -	    sock->type == SOCK_RAW)
> +	if (!skb->protocol && sock->type == SOCK_RAW)
>  		skb->protocol = dev_parse_header_protocol(skb);
>  
>  	skb_probe_transport_header(skb);
> @@ -2614,7 +2613,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
>  	struct page *page;
>  	int err;
>  
> -	skb->protocol = proto;
> +	if (proto != htons(ETH_P_ALL))
> +		skb->protocol = proto;
>  	skb->dev = dev;
>  	skb->priority = sockc->priority;
>  	skb->mark = sockc->mark;
> @@ -2678,8 +2678,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
>  	if (unlikely(!skb->len))
>  		return -EINVAL;
>  
> -	packet_parse_headers(skb, sock);
> -
>  	return tp_len;
>  }
>  
> @@ -2919,9 +2917,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
>  				tp_len = -EINVAL;
>  				goto tpacket_error;
>  			}
> -			virtio_net_hdr_set_proto(skb, &vnet_hdr);
>  		}
>  
> +		packet_parse_headers(skb, po->sk.sk_socket);
> +
> +		if (has_vnet_hdr)
> +			virtio_net_hdr_set_proto(skb, &vnet_hdr);
> +
>  		uarg = kmalloc(sizeof(*uarg), GFP_KERNEL);
>  		if (unlikely(!uarg)) {
>  			if (likely(len_sum > 0))
> @@ -3122,7 +3124,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
>  		goto out_free;
>  	}
>  
> -	skb->protocol = proto;
> +	if (proto != htons(ETH_P_ALL))
> +		skb->protocol = proto;
>  	skb->dev = dev;
>  	skb->priority = sockc.priority;
>  	skb->mark = sockc.mark;
> @@ -3131,16 +3134,18 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
>  	if (unlikely(extra_len == 4))
>  		skb->no_fcs = 1;
>  
> -	packet_parse_headers(skb, sock);
> -
>  	if (vnet_hdr_sz) {
>  		err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le());
>  		if (err)
>  			goto out_free;
>  		len += vnet_hdr_sz;
> -		virtio_net_hdr_set_proto(skb, &vnet_hdr);
>  	}
>  
> +	packet_parse_headers(skb, sock);
> +
> +	if (vnet_hdr_sz)
> +		virtio_net_hdr_set_proto(skb, &vnet_hdr);
> +
>  	err = packet_xmit(po, skb);
>  
>  	if (unlikely(err != 0)) {
> -- 
> 2.56.0.360.g66cac248cb-goog