[PATCH net] net/packet: call packet_parse_headers after virtio_net_hdr_to_skb

[PATCH net] net/packet: call packet_parse_headers after virtio_net_hdr_to_skb

[Willem de Bruijn]

From: Willem de Bruijn <willemb@google.com>

SOCK_RAW packet sockets incorrectly drop VLAN-tagged GSO packets
without VIRTIO_NET_HDR_F_NEEDS_CSUM.

packet_parse_headers() sets skb->protocol to VLAN but advances
skb->network_header past the VLAN tags. virtio_net_hdr_to_skb()
then flow dissects these packets, which parses the network header as a
VLAN tag, and fails.

Call packet_parse_headers() after virtio_net_hdr_to_skb() instead.

This matches tun_get_user() and tap_get_user() and thus simplifies
overall complexity.

Commit 01fdecc0480d ("net: packet: fix wrong transport_header when
sending VLAN-tagged frame") fixed the same issue for the transport
header probe in packet_parse_headers(). That probe is now skipped if
virtio_net_hdr_to_skb() already set the transport header, avoiding a
redundant dissection.

Implementation details:
- Do not set skb->protocol to the RX wildcard ETH_P_ALL. SOCK_RAW then
  derives it from the link layer header, as before. SOCK_DGRAM now
  leaves it 0, or derives it from gso_type for GSO with NEEDS_CSUM.
- Keep virtio_net_hdr_set_proto() last, so that the link layer protocol
  takes priority over gso_type.

Reported-by: Junnan Zhang <zhangjn_dev@163.com>
Closes: https://lore.kernel.org/netdev/20260821085722.24036-1-zhangjn_dev@163.com/
Fixes: dfed913e8b55 ("net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO")
Signed-off-by: Willem de Bruijn <willemb@google.com>

---

This was discovered through the report linked in the Closes: tag.

Also independently reported by LLM code reviews as pre-existing issue,
and verified with a reproducer.
---
 net/packet/af_packet.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 6ff16eef24f4..52ae3d875e97 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1943,8 +1943,7 @@ static void packet_parse_headers(struct sk_buff *skb, struct socket *sock)
 	/* On TX skb->data is the L2 header; anchor it for all socket types. */
 	skb_reset_mac_header(skb);
 
-	if ((!skb->protocol || skb->protocol == htons(ETH_P_ALL)) &&
-	    sock->type == SOCK_RAW)
+	if (!skb->protocol && sock->type == SOCK_RAW)
 		skb->protocol = dev_parse_header_protocol(skb);
 
 	skb_probe_transport_header(skb);
@@ -2614,7 +2613,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
 	struct page *page;
 	int err;
 
-	skb->protocol = proto;
+	if (proto != htons(ETH_P_ALL))
+		skb->protocol = proto;
 	skb->dev = dev;
 	skb->priority = sockc->priority;
 	skb->mark = sockc->mark;
@@ -2678,8 +2678,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
 	if (unlikely(!skb->len))
 		return -EINVAL;
 
-	packet_parse_headers(skb, sock);
-
 	return tp_len;
 }
 
@@ -2919,9 +2917,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 				tp_len = -EINVAL;
 				goto tpacket_error;
 			}
-			virtio_net_hdr_set_proto(skb, &vnet_hdr);
 		}
 
+		packet_parse_headers(skb, po->sk.sk_socket);
+
+		if (has_vnet_hdr)
+			virtio_net_hdr_set_proto(skb, &vnet_hdr);
+
 		uarg = kmalloc(sizeof(*uarg), GFP_KERNEL);
 		if (unlikely(!uarg)) {
 			if (likely(len_sum > 0))
@@ -3122,7 +3124,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 		goto out_free;
 	}
 
-	skb->protocol = proto;
+	if (proto != htons(ETH_P_ALL))
+		skb->protocol = proto;
 	skb->dev = dev;
 	skb->priority = sockc.priority;
 	skb->mark = sockc.mark;
@@ -3131,16 +3134,18 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 	if (unlikely(extra_len == 4))
 		skb->no_fcs = 1;
 
-	packet_parse_headers(skb, sock);
-
 	if (vnet_hdr_sz) {
 		err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le());
 		if (err)
 			goto out_free;
 		len += vnet_hdr_sz;
-		virtio_net_hdr_set_proto(skb, &vnet_hdr);
 	}
 
+	packet_parse_headers(skb, sock);
+
+	if (vnet_hdr_sz)
+		virtio_net_hdr_set_proto(skb, &vnet_hdr);
+
 	err = packet_xmit(po, skb);
 
 	if (unlikely(err != 0)) {
-- 
2.56.0.360.g66cac248cb-goog

Re: [PATCH net] net/packet: call packet_parse_headers after virtio_net_hdr_to_skb

[Michael S. Tsirkin]

On Wed, Oct 07, 2026 at 01:57:30PM -0400, Willem de Bruijn wrote:
> From: Willem de Bruijn <willemb@google.com>
> 
> SOCK_RAW packet sockets incorrectly drop VLAN-tagged GSO packets
> without VIRTIO_NET_HDR_F_NEEDS_CSUM.
> 
> packet_parse_headers() sets skb->protocol to VLAN but advances
> skb->network_header past the VLAN tags. virtio_net_hdr_to_skb()
> then flow dissects these packets, which parses the network header as a
> VLAN tag, and fails.
> 
> Call packet_parse_headers() after virtio_net_hdr_to_skb() instead.
> 
> This matches tun_get_user() and tap_get_user() and thus simplifies
> overall complexity.
> 
> Commit 01fdecc0480d ("net: packet: fix wrong transport_header when
> sending VLAN-tagged frame") fixed the same issue for the transport
> header probe in packet_parse_headers(). That probe is now skipped if
> virtio_net_hdr_to_skb() already set the transport header, avoiding a
> redundant dissection.
> 
> Implementation details:
> - Do not set skb->protocol to the RX wildcard ETH_P_ALL. SOCK_RAW then
>   derives it from the link layer header, as before. SOCK_DGRAM now
>   leaves it 0, or derives it from gso_type for GSO with NEEDS_CSUM.
> - Keep virtio_net_hdr_set_proto() last, so that the link layer protocol
>   takes priority over gso_type.
> 
> Reported-by: Junnan Zhang <zhangjn_dev@163.com>
> Closes: https://lore.kernel.org/netdev/20260821085722.24036-1-zhangjn_dev@163.com/
> Fixes: dfed913e8b55 ("net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO")
> Signed-off-by: Willem de Bruijn <willemb@google.com>


Acked-by: Michael S. Tsirkin <mst@redhat.com>

> ---
> 
> This was discovered through the report linked in the Closes: tag.
> 
> Also independently reported by LLM code reviews as pre-existing issue,
> and verified with a reproducer.
> ---
>  net/packet/af_packet.c | 25 +++++++++++++++----------
>  1 file changed, 15 insertions(+), 10 deletions(-)
> 
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index 6ff16eef24f4..52ae3d875e97 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -1943,8 +1943,7 @@ static void packet_parse_headers(struct sk_buff *skb, struct socket *sock)
>  	/* On TX skb->data is the L2 header; anchor it for all socket types. */
>  	skb_reset_mac_header(skb);
>  
> -	if ((!skb->protocol || skb->protocol == htons(ETH_P_ALL)) &&
> -	    sock->type == SOCK_RAW)
> +	if (!skb->protocol && sock->type == SOCK_RAW)
>  		skb->protocol = dev_parse_header_protocol(skb);
>  
>  	skb_probe_transport_header(skb);
> @@ -2614,7 +2613,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
>  	struct page *page;
>  	int err;
>  
> -	skb->protocol = proto;
> +	if (proto != htons(ETH_P_ALL))
> +		skb->protocol = proto;
>  	skb->dev = dev;
>  	skb->priority = sockc->priority;
>  	skb->mark = sockc->mark;
> @@ -2678,8 +2678,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
>  	if (unlikely(!skb->len))
>  		return -EINVAL;
>  
> -	packet_parse_headers(skb, sock);
> -
>  	return tp_len;
>  }
>  
> @@ -2919,9 +2917,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
>  				tp_len = -EINVAL;
>  				goto tpacket_error;
>  			}
> -			virtio_net_hdr_set_proto(skb, &vnet_hdr);
>  		}
>  
> +		packet_parse_headers(skb, po->sk.sk_socket);
> +
> +		if (has_vnet_hdr)
> +			virtio_net_hdr_set_proto(skb, &vnet_hdr);
> +
>  		uarg = kmalloc(sizeof(*uarg), GFP_KERNEL);
>  		if (unlikely(!uarg)) {
>  			if (likely(len_sum > 0))
> @@ -3122,7 +3124,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
>  		goto out_free;
>  	}
>  
> -	skb->protocol = proto;
> +	if (proto != htons(ETH_P_ALL))
> +		skb->protocol = proto;
>  	skb->dev = dev;
>  	skb->priority = sockc.priority;
>  	skb->mark = sockc.mark;
> @@ -3131,16 +3134,18 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
>  	if (unlikely(extra_len == 4))
>  		skb->no_fcs = 1;
>  
> -	packet_parse_headers(skb, sock);
> -
>  	if (vnet_hdr_sz) {
>  		err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le());
>  		if (err)
>  			goto out_free;
>  		len += vnet_hdr_sz;
> -		virtio_net_hdr_set_proto(skb, &vnet_hdr);
>  	}
>  
> +	packet_parse_headers(skb, sock);
> +
> +	if (vnet_hdr_sz)
> +		virtio_net_hdr_set_proto(skb, &vnet_hdr);
> +
>  	err = packet_xmit(po, skb);
>  
>  	if (unlikely(err != 0)) {
> -- 
> 2.56.0.360.g66cac248cb-goog

Re: [PATCH net] net/packet: call packet_parse_headers after virtio_net_hdr_to_skb

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed,  7 Oct 2026 13:57:30 -0400 you wrote:
> From: Willem de Bruijn <willemb@google.com>
> 
> SOCK_RAW packet sockets incorrectly drop VLAN-tagged GSO packets
> without VIRTIO_NET_HDR_F_NEEDS_CSUM.
> 
> packet_parse_headers() sets skb->protocol to VLAN but advances
> skb->network_header past the VLAN tags. virtio_net_hdr_to_skb()
> then flow dissects these packets, which parses the network header as a
> VLAN tag, and fails.
> 
> [...]

Here is the summary with links:
  - [net] net/packet: call packet_parse_headers after virtio_net_hdr_to_skb
    https://git.kernel.org/netdev/net/c/513e23857a3a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html