[PATCH] net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

[PATCH] net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

[Yun Zhou]

Before commit 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to
dev->lltx"), NETIF_F_LLTX was set unconditionally in __gre_tunnel_init()
alongside GRE_FEATURES:

    dev->features |= GRE_FEATURES | NETIF_F_LLTX;

When that commit converted NETIF_F_LLTX to the dev->lltx flag, it
placed 'dev->lltx = true' after the SEQ/CSUM early returns instead
of before them. This causes GRE/GRETAP tunnels with SEQ or CSUM+encap
to lose lockless TX, reintroducing _xmit_lock acquisition around their
ndo_start_xmit. Since GRE xmit re-enters the stack via
ip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the
underlay device.

  CPU0                        CPU1
  ----                        ----
  lock(&qdisc_xmit_lock_key#6);
                              lock(&qdisc_xmit_lock_key#3);
                              lock(&qdisc_xmit_lock_key#6);
  lock(&qdisc_xmit_lock_key#3);

Fix by moving dev->lltx = true before the early returns, restoring
the original unconditional behavior.

Fixes: 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to dev->lltx")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
---
 net/ipv4/ip_gre.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 9fbff16cda1d..8c5ad8ec8d09 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1018,6 +1018,8 @@ static void __gre_tunnel_init(struct net_device *dev)
 	dev->features		|= GRE_FEATURES;
 	dev->hw_features	|= GRE_FEATURES;
 
+	dev->lltx = true;
+
 	/* TCP offload with GRE SEQ is not supported, nor can we support 2
 	 * levels of outer headers requiring an update.
 	 */
@@ -1029,8 +1031,6 @@ static void __gre_tunnel_init(struct net_device *dev)
 
 	dev->features |= NETIF_F_GSO_SOFTWARE;
 	dev->hw_features |= NETIF_F_GSO_SOFTWARE;
-
-	dev->lltx = true;
 }
 
 static int ipgre_tunnel_init(struct net_device *dev)
-- 
2.43.0

Re: [PATCH] net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

[Ido Schimmel]

Patch prefix should be [PATCH net]:

https://docs.kernel.org/process/maintainer-netdev.html

On Thu, Jul 09, 2026 at 06:52:43PM +0800, Yun Zhou wrote:
> Before commit 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to
> dev->lltx"), NETIF_F_LLTX was set unconditionally in __gre_tunnel_init()
> alongside GRE_FEATURES:
> 
>     dev->features |= GRE_FEATURES | NETIF_F_LLTX;
> 
> When that commit converted NETIF_F_LLTX to the dev->lltx flag, it
> placed 'dev->lltx = true' after the SEQ/CSUM early returns instead
> of before them. This causes GRE/GRETAP tunnels with SEQ or CSUM+encap
> to lose lockless TX, reintroducing _xmit_lock acquisition around their
> ndo_start_xmit. Since GRE xmit re-enters the stack via
> ip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the
> underlay device.
> 
>   CPU0                        CPU1
>   ----                        ----
>   lock(&qdisc_xmit_lock_key#6);
>                               lock(&qdisc_xmit_lock_key#3);
>                               lock(&qdisc_xmit_lock_key#6);
>   lock(&qdisc_xmit_lock_key#3);
> 
> Fix by moving dev->lltx = true before the early returns, restoring
> the original unconditional behavior.
> 
> Fixes: 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to dev->lltx")

Both sashiko instances indicate that this commit introduced the same bug
in ip6gre_tnl_init_features(). Please perform the same fix there and
fold it into v2.

> Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
> ---
>  net/ipv4/ip_gre.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
> index 9fbff16cda1d..8c5ad8ec8d09 100644
> --- a/net/ipv4/ip_gre.c
> +++ b/net/ipv4/ip_gre.c
> @@ -1018,6 +1018,8 @@ static void __gre_tunnel_init(struct net_device *dev)
>  	dev->features		|= GRE_FEATURES;
>  	dev->hw_features	|= GRE_FEATURES;
>  
> +	dev->lltx = true;
> +
>  	/* TCP offload with GRE SEQ is not supported, nor can we support 2
>  	 * levels of outer headers requiring an update.
>  	 */
> @@ -1029,8 +1031,6 @@ static void __gre_tunnel_init(struct net_device *dev)
>  
>  	dev->features |= NETIF_F_GSO_SOFTWARE;
>  	dev->hw_features |= NETIF_F_GSO_SOFTWARE;
> -
> -	dev->lltx = true;
>  }
>  
>  static int ipgre_tunnel_init(struct net_device *dev)
> -- 
> 2.43.0
> 

Re: [PATCH] net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

[Zhou, Yun]

On 7/13/26 16:53, Ido Schimmel wrote:
> 
> Patch prefix should be [PATCH net]:
> 
> https://docs.kernel.org/process/maintainer-netdev.html
> 
> On Thu, Jul 09, 2026 at 06:52:43PM +0800, Yun Zhou wrote:
>> Before commit 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to
>> dev->lltx"), NETIF_F_LLTX was set unconditionally in __gre_tunnel_init()
>> alongside GRE_FEATURES:
>>
>>      dev->features |= GRE_FEATURES | NETIF_F_LLTX;
>>
>> When that commit converted NETIF_F_LLTX to the dev->lltx flag, it
>> placed 'dev->lltx = true' after the SEQ/CSUM early returns instead
>> of before them. This causes GRE/GRETAP tunnels with SEQ or CSUM+encap
>> to lose lockless TX, reintroducing _xmit_lock acquisition around their
>> ndo_start_xmit. Since GRE xmit re-enters the stack via
>> ip_tunnel_xmit(), holding _xmit_lock risks ABBA deadlock with the
>> underlay device.
>>
>>    CPU0                        CPU1
>>    ----                        ----
>>    lock(&qdisc_xmit_lock_key#6);
>>                                lock(&qdisc_xmit_lock_key#3);
>>                                lock(&qdisc_xmit_lock_key#6);
>>    lock(&qdisc_xmit_lock_key#3);
>>
>> Fix by moving dev->lltx = true before the early returns, restoring
>> the original unconditional behavior.
>>
>> Fixes: 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to dev->lltx")
> 
> Both sashiko instances indicate that this commit introduced the same bug
> in ip6gre_tnl_init_features(). Please perform the same fix there and
> fold it into v2.
> 

Thanks a lot for your review. IPv6 indeed has the same issue. I will fix 
it in v2 as you suggested.

BR,
Yun