Re: [PATCH net v3] net/packet: fix network header offset for non-VLAN raw packets on VLAN subinterfaces

[Junnan Zhang <zhangjn_dev@163.com>]

Hi,

The High finding from the Sashiko review is correct.

Commit 447cbe95ebb953 ("vlan: fix skb_under_panic and races when
toggling HW VLAN offload") is now in mainline (v7.3-rc1). It makes
vlan_dev_init() keep hard_header_len == real_dev->hard_header_len
unconditionally and accounts VLAN tag space in needed_headroom
instead.

With that change, a VLAN subinterface on a plain Ethernet NIC has
hard_header_len == min_header_len == ETH_HLEN, so packet_snd() already
places network_header at the L2/L3 boundary of the user-supplied
frame. The branch added by this patch writes back the identical value
and is a no-op. I applied 447cbe95ebb953 on my baseline and re-ran my
reproducer (virtio_net without NETIF_F_HW_VLAN_CTAG_TX, AF_PACKET
SOCK_RAW + PACKET_VNET_HDR over a VLAN subinterface): the failure is
gone.

On the Medium finding: the concern is valid. For a VLAN subinterface
over a with hard_header_len < min_header_len (e.g.
cx82310_eth, which sets hard_header_len = 0), the new branch would
point network_header at min_header_len even for frames shorter than
that, recreating the mac_len > skb->len state that 993675a3100b1
(": reset network header if packet shorter than ll reserved
space") was written to avoid. Had the patch survived, it would need a
frame-length guard (e.g. skb->len >= skb->dev->min_header_len).

My v1-v3 baseline predated 447cbe95ebb953, which is why the issue
reproduced back then. The patch is now superseded; please drop it if
it is still queued.

Willem, thank you for the thorough reviews on all three versions.

Thanks,
Junnan