[PATCH v3 net] vlan: fix skb_under_panic and races when toggling HW VLAN offload

[PATCH v3 net] vlan: fix skb_under_panic and races when toggling HW VLAN offload

[Eric Dumazet]

Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or
NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),
which dynamically changed vlandev->hard_header_len.

This causes two issues:
1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)
   read dev->hard_header_len without holding RTNL lock. Mutating
   hard_header_len dynamically under RTNL creates a data race where upper
   layers reserve insufficient headroom based on a stale hard_header_len,
   resulting in skb_under_panic when vlan_dev_hard_header() is called.
2. In addition, vlan_transfer_features() updated hard_header_len without
   updating header_ops, causing a mismatch between allocated headroom
   and header creation.

Always setting dev->hard_header_len = real_dev->hard_header_len and
dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally
ensures:
- dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len,
  eliminating all dynamic runtime updates and data races on hard_header_len.
- Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve
  sufficient headroom for software VLAN tag insertion (real_dev->hard_header_len +
  real_dev->needed_headroom + VLAN_HLEN).
- vlandev inherits real_dev->needed_tailroom so underlying trailer/padding/ICV
  requirements are honored.
- AF_PACKET SOCK_RAW network header offsets remain correctly aligned at
  real_dev->hard_header_len.
- vlan_header_ops is used unconditionally.

Note to stable teams: Make sure to backport these commits:

e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev")
cef51860becd ("macvlan: inherit needed_headroom and needed_tailroom from lowerdev")

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Tangxin Xie <xietangxin@h-partners.com>
Closes: https://lore.kernel.org/netdev/99d678ae-c7b2-4b44-b534-b8320679deb3@h-partners.com/
Cc: <stable@vger.kernel.org> # 3.19: e16e960d55a4: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
Cc: <stable@vger.kernel.org> # 3.19: cef51860becd: macvlan: inherit needed_headroom and needed_tailroom from lowerdev
Cc: <stable@vger.kernel.org> # 3.19
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
v3: propagate needed_tailroom, add stable tags.
v2: https://lore.kernel.org/netdev/20260724035419.1473174-1-edumazet@google.com/

 net/8021q/vlan_dev.c | 39 +++++++--------------------------------
 1 file changed, 7 insertions(+), 32 deletions(-)

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index ec2569b3f8dac629027b4344bc89402decf026d1..2859cbac3f266b7c4e3f44f41280d33ab69c5270 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -502,26 +502,6 @@ static const struct header_ops vlan_header_ops = {
 	.parse_protocol = vlan_parse_protocol,
 };
 
-static int vlan_passthru_hard_header(struct sk_buff *skb, struct net_device *dev,
-				     unsigned short type,
-				     const void *daddr, const void *saddr,
-				     unsigned int len)
-{
-	struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
-	struct net_device *real_dev = vlan->real_dev;
-
-	if (saddr == NULL)
-		saddr = dev->dev_addr;
-
-	return dev_hard_header(skb, real_dev, type, daddr, saddr, len);
-}
-
-static const struct header_ops vlan_passthru_header_ops = {
-	.create	 = vlan_passthru_hard_header,
-	.parse	 = eth_header_parse,
-	.parse_protocol = vlan_parse_protocol,
-};
-
 static const struct device_type vlan_type = {
 	.name	= "vlan",
 };
@@ -580,14 +560,10 @@ static int vlan_dev_init(struct net_device *dev)
 	dev->fcoe_ddp_xid = real_dev->fcoe_ddp_xid;
 #endif
 
-	dev->needed_headroom = real_dev->needed_headroom;
-	if (vlan_hw_offload_capable(real_dev->features, vlan->vlan_proto)) {
-		dev->header_ops      = &vlan_passthru_header_ops;
-		dev->hard_header_len = real_dev->hard_header_len;
-	} else {
-		dev->header_ops      = &vlan_header_ops;
-		dev->hard_header_len = real_dev->hard_header_len + VLAN_HLEN;
-	}
+	dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN;
+	dev->needed_tailroom = real_dev->needed_tailroom;
+	dev->header_ops      = &vlan_header_ops;
+	dev->hard_header_len = real_dev->hard_header_len;
 
 	dev->netdev_ops = &vlan_netdev_ops;
 
@@ -1029,10 +1005,9 @@ static void vlan_transfer_features(struct net_device *dev,
 
 	netif_inherit_tso_max(vlandev, dev);
 
-	if (vlan_hw_offload_capable(dev->features, vlan->vlan_proto))
-		vlandev->hard_header_len = dev->hard_header_len;
-	else
-		vlandev->hard_header_len = dev->hard_header_len + VLAN_HLEN;
+	vlandev->needed_headroom = dev->needed_headroom + VLAN_HLEN;
+	vlandev->needed_tailroom = dev->needed_tailroom;
+	vlandev->hard_header_len = dev->hard_header_len;
 
 #if IS_ENABLED(CONFIG_FCOE)
 	vlandev->fcoe_ddp_xid = dev->fcoe_ddp_xid;
-- 
2.55.0.679.g6767b8d81c-goog

Re: [PATCH v3 net] vlan: fix skb_under_panic and races when toggling HW VLAN offload

[Paolo Abeni]

On 8/11/26 10:52 AM, Eric Dumazet wrote:
> Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or
> NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),
> which dynamically changed vlandev->hard_header_len.
> 
> This causes two issues:
> 1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)
>    read dev->hard_header_len without holding RTNL lock. Mutating
>    hard_header_len dynamically under RTNL creates a data race where upper
>    layers reserve insufficient headroom based on a stale hard_header_len,
>    resulting in skb_under_panic when vlan_dev_hard_header() is called.
> 2. In addition, vlan_transfer_features() updated hard_header_len without
>    updating header_ops, causing a mismatch between allocated headroom
>    and header creation.
> 
> Always setting dev->hard_header_len = real_dev->hard_header_len and
> dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally
> ensures:
> - dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len,
>   eliminating all dynamic runtime updates and data races on hard_header_len.
> - Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve
>   sufficient headroom for software VLAN tag insertion (real_dev->hard_header_len +
>   real_dev->needed_headroom + VLAN_HLEN).
> - vlandev inherits real_dev->needed_tailroom so underlying trailer/padding/ICV
>   requirements are honored.
> - AF_PACKET SOCK_RAW network header offsets remain correctly aligned at
>   real_dev->hard_header_len.
> - vlan_header_ops is used unconditionally.
> 
> Note to stable teams: Make sure to backport these commits:
> 
> e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev")
> cef51860becd ("macvlan: inherit needed_headroom and needed_tailroom from lowerdev")
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Tangxin Xie <xietangxin@h-partners.com>
> Closes: https://lore.kernel.org/netdev/99d678ae-c7b2-4b44-b534-b8320679deb3@h-partners.com/
> Cc: <stable@vger.kernel.org> # 3.19: e16e960d55a4: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
> Cc: <stable@vger.kernel.org> # 3.19: cef51860becd: macvlan: inherit needed_headroom and needed_tailroom from lowerdev
> Cc: <stable@vger.kernel.org> # 3.19
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> v3: propagate needed_tailroom, add stable tags.
> v2: https://lore.kernel.org/netdev/20260724035419.1473174-1-edumazet@google.com/
> 
>  net/8021q/vlan_dev.c | 39 +++++++--------------------------------
>  1 file changed, 7 insertions(+), 32 deletions(-)
> 
> diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
> index ec2569b3f8dac629027b4344bc89402decf026d1..2859cbac3f266b7c4e3f44f41280d33ab69c5270 100644
> --- a/net/8021q/vlan_dev.c
> +++ b/net/8021q/vlan_dev.c
> @@ -502,26 +502,6 @@ static const struct header_ops vlan_header_ops = {
>  	.parse_protocol = vlan_parse_protocol,
>  };
>  
> -static int vlan_passthru_hard_header(struct sk_buff *skb, struct net_device *dev,
> -				     unsigned short type,
> -				     const void *daddr, const void *saddr,
> -				     unsigned int len)
> -{
> -	struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
> -	struct net_device *real_dev = vlan->real_dev;
> -
> -	if (saddr == NULL)
> -		saddr = dev->dev_addr;
> -
> -	return dev_hard_header(skb, real_dev, type, daddr, saddr, len);
> -}
> -
> -static const struct header_ops vlan_passthru_header_ops = {
> -	.create	 = vlan_passthru_hard_header,
> -	.parse	 = eth_header_parse,
> -	.parse_protocol = vlan_parse_protocol,
> -};
> -
>  static const struct device_type vlan_type = {
>  	.name	= "vlan",
>  };
> @@ -580,14 +560,10 @@ static int vlan_dev_init(struct net_device *dev)
>  	dev->fcoe_ddp_xid = real_dev->fcoe_ddp_xid;
>  #endif
>  
> -	dev->needed_headroom = real_dev->needed_headroom;
> -	if (vlan_hw_offload_capable(real_dev->features, vlan->vlan_proto)) {
> -		dev->header_ops      = &vlan_passthru_header_ops;
> -		dev->hard_header_len = real_dev->hard_header_len;
> -	} else {
> -		dev->header_ops      = &vlan_header_ops;
> -		dev->hard_header_len = real_dev->hard_header_len + VLAN_HLEN;

Sashiko nipa points to a possible functional and performance regression
with unusual config (reorder_hdr off):

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260811085246.2267779-1-edumazet%40google.com

Arguably the current behavior is incorrect, but it's also the
established one. WDYT?

/P

Re: [PATCH v3 net] vlan: fix skb_under_panic and races when toggling HW VLAN offload

[xietangxin]

On 8/13/2026 4:49 PM, Paolo Abeni wrote:
> On 8/11/26 10:52 AM, Eric Dumazet wrote:
>> Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or
>> NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),
>> which dynamically changed vlandev->hard_header_len.
>>
>> This causes two issues:
>> 1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)
>>    read dev->hard_header_len without holding RTNL lock. Mutating
>>    hard_header_len dynamically under RTNL creates a data race where upper
>>    layers reserve insufficient headroom based on a stale hard_header_len,
>>    resulting in skb_under_panic when vlan_dev_hard_header() is called.
>> 2. In addition, vlan_transfer_features() updated hard_header_len without
>>    updating header_ops, causing a mismatch between allocated headroom
>>    and header creation.
>>
>> Always setting dev->hard_header_len = real_dev->hard_header_len and
>> dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally
>> ensures:
>> - dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len,
>>   eliminating all dynamic runtime updates and data races on hard_header_len.
>> - Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve
>>   sufficient headroom for software VLAN tag insertion (real_dev->hard_header_len +
>>   real_dev->needed_headroom + VLAN_HLEN).
>> - vlandev inherits real_dev->needed_tailroom so underlying trailer/padding/ICV
>>   requirements are honored.
>> - AF_PACKET SOCK_RAW network header offsets remain correctly aligned at
>>   real_dev->hard_header_len.
>> - vlan_header_ops is used unconditionally.
>>
>> Note to stable teams: Make sure to backport these commits:
>>
>> e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev")
>> cef51860becd ("macvlan: inherit needed_headroom and needed_tailroom from lowerdev")
>>
>> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>> Reported-by: Tangxin Xie <xietangxin@h-partners.com>
>> Closes: https://lore.kernel.org/netdev/99d678ae-c7b2-4b44-b534-b8320679deb3@h-partners.com/
>> Cc: <stable@vger.kernel.org> # 3.19: e16e960d55a4: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
>> Cc: <stable@vger.kernel.org> # 3.19: cef51860becd: macvlan: inherit needed_headroom and needed_tailroom from lowerdev
>> Cc: <stable@vger.kernel.org> # 3.19
>> Signed-off-by: Eric Dumazet <edumazet@google.com>
>> ---
>> v3: propagate needed_tailroom, add stable tags.
>> v2: https://lore.kernel.org/netdev/20260724035419.1473174-1-edumazet@google.com/
>>
>>  net/8021q/vlan_dev.c | 39 +++++++--------------------------------
>>  1 file changed, 7 insertions(+), 32 deletions(-)
>>
>> diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
>> index ec2569b3f8dac629027b4344bc89402decf026d1..2859cbac3f266b7c4e3f44f41280d33ab69c5270 100644
>> --- a/net/8021q/vlan_dev.c
>> +++ b/net/8021q/vlan_dev.c
>> @@ -502,26 +502,6 @@ static const struct header_ops vlan_header_ops = {
>>  	.parse_protocol = vlan_parse_protocol,
>>  };
>>  
>> -static int vlan_passthru_hard_header(struct sk_buff *skb, struct net_device *dev,
>> -				     unsigned short type,
>> -				     const void *daddr, const void *saddr,
>> -				     unsigned int len)
>> -{
>> -	struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
>> -	struct net_device *real_dev = vlan->real_dev;
>> -
>> -	if (saddr == NULL)
>> -		saddr = dev->dev_addr;
>> -
>> -	return dev_hard_header(skb, real_dev, type, daddr, saddr, len);
>> -}
>> -
>> -static const struct header_ops vlan_passthru_header_ops = {
>> -	.create	 = vlan_passthru_hard_header,
>> -	.parse	 = eth_header_parse,
>> -	.parse_protocol = vlan_parse_protocol,
>> -};
>> -
>>  static const struct device_type vlan_type = {
>>  	.name	= "vlan",
>>  };
>> @@ -580,14 +560,10 @@ static int vlan_dev_init(struct net_device *dev)
>>  	dev->fcoe_ddp_xid = real_dev->fcoe_ddp_xid;
>>  #endif
>>  
>> -	dev->needed_headroom = real_dev->needed_headroom;
>> -	if (vlan_hw_offload_capable(real_dev->features, vlan->vlan_proto)) {
>> -		dev->header_ops      = &vlan_passthru_header_ops;
>> -		dev->hard_header_len = real_dev->hard_header_len;
>> -	} else {
>> -		dev->header_ops      = &vlan_header_ops;
>> -		dev->hard_header_len = real_dev->hard_header_len + VLAN_HLEN;
> 
> Sashiko nipa points to a possible functional and performance regression
> with unusual config (reorder_hdr off):
> 
> https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260811085246.2267779-1-edumazet%40google.com
> 
> Arguably the current behavior is incorrect, but it's also the
> established one. WDYT?
> 
> /P
> 
> 
Hi Eric,

Gently pinging on this thread.

Just wanted to check if you have any thoughts on Paolo's comment
regarding the potential regression with reorder_hdr=off?

-- 
Best regards,
Tangxin Xie

Re: [PATCH v3 net] vlan: fix skb_under_panic and races when toggling HW VLAN offload

[Eric Dumazet]

On Wed, Aug 19, 2026 at 9:49 AM xietangxin <xietangxin@h-partners.com> wrote:
>
>
>
> On 8/13/2026 4:49 PM, Paolo Abeni wrote:
> > On 8/11/26 10:52 AM, Eric Dumazet wrote:
> >> Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or
> >> NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),
> >> which dynamically changed vlandev->hard_header_len.
> >>
> >> This causes two issues:
> >> 1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)
> >>    read dev->hard_header_len without holding RTNL lock. Mutating
> >>    hard_header_len dynamically under RTNL creates a data race where upper
> >>    layers reserve insufficient headroom based on a stale hard_header_len,
> >>    resulting in skb_under_panic when vlan_dev_hard_header() is called.
> >> 2. In addition, vlan_transfer_features() updated hard_header_len without
> >>    updating header_ops, causing a mismatch between allocated headroom
> >>    and header creation.
> >>
> >> Always setting dev->hard_header_len = real_dev->hard_header_len and
> >> dev->needed_headroom = real_dev->needed_headroom + VLAN_HLEN unconditionally
> >> ensures:
> >> - dev->hard_header_len remains 100% static and immutable at real_dev->hard_header_len,
> >>   eliminating all dynamic runtime updates and data races on hard_header_len.
> >> - Upper layers allocating skbs via LL_RESERVED_SPACE() will always reserve
> >>   sufficient headroom for software VLAN tag insertion (real_dev->hard_header_len +
> >>   real_dev->needed_headroom + VLAN_HLEN).
> >> - vlandev inherits real_dev->needed_tailroom so underlying trailer/padding/ICV
> >>   requirements are honored.
> >> - AF_PACKET SOCK_RAW network header offsets remain correctly aligned at
> >>   real_dev->hard_header_len.
> >> - vlan_header_ops is used unconditionally.
> >>
> >> Note to stable teams: Make sure to backport these commits:
> >>
> >> e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev")
> >> cef51860becd ("macvlan: inherit needed_headroom and needed_tailroom from lowerdev")
> >>
> >> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> >> Reported-by: Tangxin Xie <xietangxin@h-partners.com>
> >> Closes: https://lore.kernel.org/netdev/99d678ae-c7b2-4b44-b534-b8320679deb3@h-partners.com/
> >> Cc: <stable@vger.kernel.org> # 3.19: e16e960d55a4: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
> >> Cc: <stable@vger.kernel.org> # 3.19: cef51860becd: macvlan: inherit needed_headroom and needed_tailroom from lowerdev
> >> Cc: <stable@vger.kernel.org> # 3.19
> >> Signed-off-by: Eric Dumazet <edumazet@google.com>
> >> ---
> >> v3: propagate needed_tailroom, add stable tags.
> >> v2: https://lore.kernel.org/netdev/20260724035419.1473174-1-edumazet@google.com/
> >>
> >>  net/8021q/vlan_dev.c | 39 +++++++--------------------------------
> >>  1 file changed, 7 insertions(+), 32 deletions(-)
> >>
> >> diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
> >> index ec2569b3f8dac629027b4344bc89402decf026d1..2859cbac3f266b7c4e3f44f41280d33ab69c5270 100644
> >> --- a/net/8021q/vlan_dev.c
> >> +++ b/net/8021q/vlan_dev.c
> >> @@ -502,26 +502,6 @@ static const struct header_ops vlan_header_ops = {
> >>      .parse_protocol = vlan_parse_protocol,
> >>  };
> >>
> >> -static int vlan_passthru_hard_header(struct sk_buff *skb, struct net_device *dev,
> >> -                                 unsigned short type,
> >> -                                 const void *daddr, const void *saddr,
> >> -                                 unsigned int len)
> >> -{
> >> -    struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
> >> -    struct net_device *real_dev = vlan->real_dev;
> >> -
> >> -    if (saddr == NULL)
> >> -            saddr = dev->dev_addr;
> >> -
> >> -    return dev_hard_header(skb, real_dev, type, daddr, saddr, len);
> >> -}
> >> -
> >> -static const struct header_ops vlan_passthru_header_ops = {
> >> -    .create  = vlan_passthru_hard_header,
> >> -    .parse   = eth_header_parse,
> >> -    .parse_protocol = vlan_parse_protocol,
> >> -};
> >> -
> >>  static const struct device_type vlan_type = {
> >>      .name   = "vlan",
> >>  };
> >> @@ -580,14 +560,10 @@ static int vlan_dev_init(struct net_device *dev)
> >>      dev->fcoe_ddp_xid = real_dev->fcoe_ddp_xid;
> >>  #endif
> >>
> >> -    dev->needed_headroom = real_dev->needed_headroom;
> >> -    if (vlan_hw_offload_capable(real_dev->features, vlan->vlan_proto)) {
> >> -            dev->header_ops      = &vlan_passthru_header_ops;
> >> -            dev->hard_header_len = real_dev->hard_header_len;
> >> -    } else {
> >> -            dev->header_ops      = &vlan_header_ops;
> >> -            dev->hard_header_len = real_dev->hard_header_len + VLAN_HLEN;
> >
> > Sashiko nipa points to a possible functional and performance regression
> > with unusual config (reorder_hdr off):
> >
> > https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260811085246.2267779-1-edumazet%40google.com
> >
> > Arguably the current behavior is incorrect, but it's also the
> > established one. WDYT?
> >
> > /P
> >
> >
> Hi Eric,
>
> Gently pinging on this thread.
>
> Just wanted to check if you have any thoughts on Paolo's comment
> regarding the potential regression with reorder_hdr=off?
>

I probably missed Paolo answer (too many emails in my inbox).

Regarding the reorder_hdr=off finding from Sashiko:

1. reorder_hdr=on is the default for VLAN devices, which continues to use
   __vlan_hwaccel_put_tag() and HW VLAN TX insertion offload as before.

2. For the rare reorder_hdr=off configuration, the intention of the flag
   is specifically to produce inline Ethernet headers, unless I am mistaken.

   Previously, whether reorder_hdr=off generated an inline tag or used HW
   offload depended on whether the lower device advertised VLAN offload
   at device creation time.

   Using vlan_header_ops unconditionally makes the behavior consistent across
   all lower devices without changing the wire format.

If you prefer, I can send a v4 clarifying this consequence in the commit
description.

I just feel the changelog has become a monster already.

Re: [PATCH v3 net] vlan: fix skb_under_panic and races when toggling HW VLAN offload

[Paolo Abeni]

On 8/19/26 10:07 AM, Eric Dumazet wrote:
> Regarding the reorder_hdr=off finding from Sashiko:
> 
> 1. reorder_hdr=on is the default for VLAN devices, which continues to use
>    __vlan_hwaccel_put_tag() and HW VLAN TX insertion offload as before.
> 
> 2. For the rare reorder_hdr=off configuration, the intention of the flag
>    is specifically to produce inline Ethernet headers, unless I am mistaken.
> 
>    Previously, whether reorder_hdr=off generated an inline tag or used HW
>    offload depended on whether the lower device advertised VLAN offload
>    at device creation time.
> 
>    Using vlan_header_ops unconditionally makes the behavior consistent across
>    all lower devices without changing the wire format.
> 
> If you prefer, I can send a v4 clarifying this consequence in the commit
> description.
IMHO it's not needed, it is enough for me that the implications are
known and well understood.

/P

Re: [PATCH v3 net] vlan: fix skb_under_panic and races when toggling HW VLAN offload

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 11 Aug 2026 08:52:46 +0000 you wrote:
> Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or
> NETIF_F_HW_VLAN_STAG_TX) on a lower device invokes vlan_transfer_features(),
> which dynamically changed vlandev->hard_header_len.
> 
> This causes two issues:
> 1. Lockless TX paths (e.g. packet_snd in af_packet.c, ip6_finish_output2)
>    read dev->hard_header_len without holding RTNL lock. Mutating
>    hard_header_len dynamically under RTNL creates a data race where upper
>    layers reserve insufficient headroom based on a stale hard_header_len,
>    resulting in skb_under_panic when vlan_dev_hard_header() is called.
> 2. In addition, vlan_transfer_features() updated hard_header_len without
>    updating header_ops, causing a mismatch between allocated headroom
>    and header creation.
> 
> [...]

Here is the summary with links:
  - [v3,net] vlan: fix skb_under_panic and races when toggling HW VLAN offload
    https://git.kernel.org/netdev/net/c/447cbe95ebb9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html