Re: [PATCH net v3] net/packet: fix network header offset for non-VLAN raw packets on VLAN subinterfaces

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

Junnan Zhang wrote:
> AF_PACKET SOCK_RAW sets skb network_header to dev->hard_header_len in
> packet_snd(). On VLAN subinterfaces with software tag insertion,
> hard_header_len includes space for the VLAN tag (ETH_HLEN + VLAN_HLEN =
> 18) while min_header_len is the on-wire Ethernet header length
> (ETH_HLEN = 14). A non-VLAN SOCK_RAW frame carries a standard 14-byte
> Ethernet header, so its L3 header sits at min_header_len, not
> hard_header_len.
> 
> packet_parse_headers() only corrects network_header for VLAN-tagged
> frames. For non-VLAN frames it leaves network_header at hard_header_len,
> so the IP header is found VLAN_HLEN bytes too late and
> inet_gso_segment() fails with -EINVAL.
> 
> Observed on a virtio_net NIC (KVM guest) that advertises
> NETIF_F_HW_VLAN_CTAG_FILTER but not NETIF_F_HW_VLAN_CTAG_TX, so VLAN
> subinterfaces use software tag insertion (hard_header_len = 18). An
> AF_PACKET SOCK_RAW socket bound to the VLAN subinterface with
> PACKET_VNET_HDR enabled sends a large IPv4/TCP frame exceeding the path
> MTU, with gso_type set in the virtio-net header. The user frame is a
> plain [ethhdr][IP...] layout without a VLAN tag;
> vlan_dev_hard_start_xmit() only attaches the tag metadata via
> __vlan_hwaccel_put_tag(), and validate_xmit_vlan() on the physical
> device later inserts the actual tag bytes via
> __vlan_hwaccel_push_inside(). With network_header stuck at 18 while the
> real IP header is at ETH_HLEN (14), inet_gso_segment() reads a
> misaligned ip_hdr(skb) and returns -EINVAL.
> 
> For non-VLAN SOCK_RAW frames on VLAN subinterfaces, set network_header
> to min_header_len so that the L3/L4 header positions match the actual
> on-the-wire frame.
> 
> This fix is placed before skb_probe_transport_header() so that both the
> transport header probe (which uses skb_network_offset() as nhoff) and
> subsequent GSO see the right L3/L4 offsets. It complements
> commit 01fdecc0480d ("net: packet: fix wrong transport_header when sending VLAN-tagged frame")
> which only covers VLAN-tagged frames.
> 
> Fixes: dfed913e8b55 ("net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO")
> Signed-off-by: Junnan Zhang <zhangjn11@chinatelecom.cn>
> Signed-off-by: Shouxin Sun <sunshx@chinatelecom.cn>
> Signed-off-by: Junnan Zhang <zhangjn_dev@163.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>