[PATCH net v5 1/3] net: virtio: account for the VLAN tag in UDP tunnel GSO offsets

[Eric Dumazet <edumazet@kernel.org>]

When the skb carries a hwaccel VLAN tag, tun_put_user() inserts the
802.1Q header in the frame it copies to user space or vhost-net, and
passes vlan_hlen = VLAN_HLEN to virtio_net_hdr_tnl_from_skb().

virtio_net_hdr_from_skb() adds vlan_hlen to csum_start, but
virtio_net_hdr_tnl_from_skb() does not add it to inner_nh_offset and
outer_th_offset. Both offsets are then 4 bytes short of the real inner
L3 and outer UDP headers in the emitted frame.

The receiver sets inner_network_header and transport_header from these
wrong offsets. This goes unnoticed for local delivery, but a forwarded
packet that gets segmented again uses the wrong inner headers. A
receiver that checks the outer headers against outer_th_offset drops
the packet instead.

tun advertises NETIF_F_HW_VLAN_CTAG_TX and NETIF_F_HW_VLAN_STAG_TX in
hw_enc_features, and its vlan_features keep the UDP tunnel GSO
features, so this happens with VLAN tagged UDP tunnel GSO traffic, for
example from a VLAN filtering bridge with a tagged port, or from a vlan
device on top of a tap.

Add vlan_hlen to both offsets, like csum_start.

virtio_net passes vlan_hlen = 0 and is not affected.

Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/netdev/179421814766.994134.3669228181251158303@kernel.org/
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
 include/linux/virtio_net.h | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index d6466f96cdd0..ab44342cf09f 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -461,8 +461,11 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb,
 	if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL_CSUM)
 		hdr->flags |= VIRTIO_NET_HDR_F_UDP_TUNNEL_CSUM;
 
-	inner_nh = skb->inner_network_header - skb_headroom(skb);
-	outer_th = skb->transport_header - skb_headroom(skb);
+	/* Like csum_start, the offsets must account for a VLAN tag
+	 * the caller inserts in the frame.
+	 */
+	inner_nh = skb->inner_network_header - skb_headroom(skb) + vlan_hlen;
+	outer_th = skb->transport_header - skb_headroom(skb) + vlan_hlen;
 	vhdr->inner_nh_offset = cpu_to_le16(inner_nh);
 	vhdr->outer_th_offset = cpu_to_le16(outer_th);
 	return 0;
-- 
2.53.0