[PATCH net] net/packet: ignore timestamp bits when testing tx frame status

[PATCH net] net/packet: ignore timestamp bits when testing tx frame status

[Willem de Bruijn]

From: Willem de Bruijn <willemb@google.com>

Since the commit in Fixes, the tx completion handler writes the frame
status as TP_STATUS_AVAILABLE | ts, where ts can be
TP_STATUS_TS_SOFTWARE or TP_STATUS_TS_RAW_HARDWARE.

Two places compare a tx frame status to TP_STATUS_AVAILABLE for
equality, and so fail to detect such a released frame:

- tpacket_snd(), when packet_xmit() fails: the packet is silently
  dropped instead of an error being returned to the caller for retry.

- packet_poll(), on the tx ring head frame: the socket is not reported
  as writable.

Mask out the timestamp bits in both. In packet_lookup_frame(), only do
so when testing a tx ring frame for TP_STATUS_AVAILABLE.

Fixes: b9c32fb27170 ("packet: if hw/sw ts enabled in rx/tx ring, report which ts we got")
Signed-off-by: Willem de Bruijn <willemb@google.com>
---
 net/packet/af_packet.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 6ff16eef24f4..1cabe292ebb4 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -398,6 +398,10 @@ static inline struct page * __pure pgv_to_page(void *addr)
 	return virt_to_page(addr);
 }
 
+/* Timestamp bits that may be set in addition to the frame state */
+static const u32 tp_status_ts_mask = TP_STATUS_TS_SOFTWARE |
+				     TP_STATUS_TS_RAW_HARDWARE;
+
 static void __packet_set_status(struct packet_sock *po, void *frame, int status)
 {
 	union tpacket_uhdr h;
@@ -519,6 +523,7 @@ static void *packet_lookup_frame(const struct packet_sock *po,
 {
 	unsigned int pg_vec_pos, frame_offset;
 	union tpacket_uhdr h;
+	u32 mask = 0;
 
 	pg_vec_pos = position / rb->frames_per_block;
 	frame_offset = position % rb->frames_per_block;
@@ -526,7 +531,10 @@ static void *packet_lookup_frame(const struct packet_sock *po,
 	h.raw = rb->pg_vec[pg_vec_pos].buffer +
 		(frame_offset * rb->frame_size);
 
-	if (status != __packet_get_status(po, h.raw))
+	if (rb == &po->tx_ring && status == TP_STATUS_AVAILABLE)
+		mask = tp_status_ts_mask;
+
+	if (status != (__packet_get_status(po, h.raw) & ~mask))
 		return NULL;
 
 	return h.raw;
@@ -2948,7 +2956,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 		if (unlikely(err != 0)) {
 			if (err > 0)
 				err = net_xmit_errno(err);
-			if (err && __packet_get_status(po, ph) ==
+			if (err && (__packet_get_status(po, ph) & ~tp_status_ts_mask) ==
 				   TP_STATUS_AVAILABLE) {
 				/* skb was destructed already */
 				skb = NULL;
-- 
2.56.0.rc1.315.gc6ed9934b7-goog

Re: [PATCH net] net/packet: ignore timestamp bits when testing tx frame status

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] net/packet: ignore timestamp bits when testing tx frame status

[Willem de Bruijn]

netdev-bot+sinfo@ wrote:
> Hi!
> 
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
> 
>  - How the issue was discovered, e.g. hit in production, hit during
>    development, syzbot report, manual code inspection, LLM or static
>    analysis tool scan.

LLM analysis. This was flagged a few times in my internal reviews.
I don't immediately have a good Link: to an external review.

>  - Whether the issue was actually triggered, or is only theoretical
>    (e.g. found by code inspection). If it was triggered please include
>    the symptoms, like the stack trace or error messages.

Analysis only.

Re: [PATCH net] net/packet: ignore timestamp bits when testing tx frame status

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sun,  4 Oct 2026 13:10:53 -0400 you wrote:
> From: Willem de Bruijn <willemb@google.com>
> 
> Since the commit in Fixes, the tx completion handler writes the frame
> status as TP_STATUS_AVAILABLE | ts, where ts can be
> TP_STATUS_TS_SOFTWARE or TP_STATUS_TS_RAW_HARDWARE.
> 
> Two places compare a tx frame status to TP_STATUS_AVAILABLE for
> equality, and so fail to detect such a released frame:
> 
> [...]

Here is the summary with links:
  - [net] net/packet: ignore timestamp bits when testing tx frame status
    https://git.kernel.org/netdev/net-next/c/88fb9fad5cbe

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html