[PATCH net] ipvlan: fix RX byte accounting for local traffic

[PATCH net] ipvlan: fix RX byte accounting for local traffic

[Xia Yan]

For traffic between ipvlan devices on the same lower device,
skb->len already includes the Ethernet header. Adding ETH_HLEN
again in ipvlan_rcv_frame() overcounts rx_bytes by 14 bytes per
packet. ipvlan_process_multicast() does the same for local broadcast
and multicast traffic.

Packets received from the lower device have had the Ethernet header
pulled by eth_type_trans(), so their counters still need ETH_HLEN.

Use the existing local and tx_pkt flags to distinguish these paths.

Sending five IPv4 UDP packets with 32-byte payloads between ipvlan
devices in separate network namespaces increases rx_bytes by 440
instead of 370. With this change the count is 370, while external
traffic is still counted correctly.

Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com>
---
Tests:
  UML: 34 cases, three runs before and after, covering IPv4/IPv6,
  L2/L3/L3S unicast, L2 broadcast and joined multicast. Payloads,
  sources and RX counters were checked.

  x86_64 W=1: full builds completed before and after the fix with
  no new diagnostics, using adjusted allmodconfig and allyesconfig
  configurations with WERROR, KASAN and KCSAN disabled. The latter
  also disabled KUNIT_ALL_TESTS and dependent tests to work around
  an existing MCTP assertion. Configuration dependency changes
  were retained.

 drivers/net/ipvlan/ipvlan_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index 7ad12dc7..ba646293 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -276,7 +276,7 @@ void ipvlan_process_multicast(struct work_struct *work)
 			if (!(ipvlan->dev->flags & IFF_UP))
 				continue;
 			ret = NET_RX_DROP;
-			len = skb->len + ETH_HLEN;
+			len = skb->len + (tx_pkt ? 0 : ETH_HLEN);
 			nskb = skb_clone(skb, GFP_ATOMIC);
 			local_bh_disable();
 			if (nskb) {
@@ -331,7 +331,7 @@ static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff **pskb,
 	bool success = false;
 	struct sk_buff *skb = *pskb;
 
-	len = skb->len + ETH_HLEN;
+	len = skb->len + (local ? 0 : ETH_HLEN);
 	/* Only packets exchanged between two local slaves need to have
 	 * device-up check as well as skb-share check.
 	 */

base-commit: 734bef548a96e8774d6eef5dfa2026c6edc4e80b

Re: [PATCH net] ipvlan: fix RX byte accounting for local traffic

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] ipvlan: fix RX byte accounting for local traffic

[Xia Yan]

Hi,

> - How the issue was discovered

Found while comparing ipvlan's local forwarding and external receive
paths: skb->len still includes the Ethernet header on the local path,
but no longer does after eth_type_trans() on the external path. Both
the unicast and multicast RX accounting added ETH_HLEN without
distinguishing the two.

Confirmed with UDP traffic between ipvlan devices in separate network
namespaces: five IPv4 packets with 32-byte UDP payloads increased
rx_bytes by 440 bytes instead of 370.

Thanks,
Xia

Re: [PATCH net] ipvlan: fix RX byte accounting for local traffic

[Eric Dumazet]

Le dim. 25 oct. 2026 à 06:21, Xia Yan <yanxia@cmss.chinamobile.com> a écrit :
>
> Hi,
>
> > - How the issue was discovered
>
> Found while comparing ipvlan's local forwarding and external receive
> paths: skb->len still includes the Ethernet header on the local path,
> but no longer does after eth_type_trans() on the external path. Both
> the unicast and multicast RX accounting added ETH_HLEN without
> distinguishing the two.
>
> Confirmed with UDP traffic between ipvlan devices in separate network
> namespaces: five IPv4 packets with 32-byte UDP payloads increased
> rx_bytes by 440 bytes instead of 370.

This is probably not a net candidate. No need for CC: stable

Also macvlan has the same issue, maybe wait for net-next reopening to
send a series fixing both ?

Re: [PATCH net] ipvlan: fix RX byte accounting for local traffic

[Xia Yan]

Hi Eric,

> Also macvlan has the same issue, maybe wait for net-next reopening to
> send a series fixing both ?

I reproduced it in macvlan bridge mode on a 6.6-based kernel. For local
broadcast and multicast, five IPv4 UDP frames with 32-byte payloads
increased rx_bytes by 440 bytes instead of 370. The captured frames
matched what was sent. Local unicast and traffic received from the lower
device were counted correctly.

I'll prepare a net-next series fixing both drivers, without Cc: stable,
and send it when net-next reopens.

Thanks,
Xia