[PATCH RFC net 0/3] net: fix stacked VLAN header corruption in TX offloads and OVS

[Gabriel Goller <g.goller@proxmox.com>]

Since commit 938863727076 ("tc: adjust network header after 2nd vlan
push"), a second VLAN push leaves network_header pointing to the
in-band VLAN header. The igb driver TSO and OVS IP set actions still
expect the L3 header, so they write to the VLAN header and corrupt
the packet. Patch 1 restores the L3 header in validate_xmit_skb() for
CHECKSUM_PARTIAL packets, which covers packets tagged by tc or BPF.
Patch 2 restores it in OVS right after the push, before later actions
run. Patch 3 adds a KUnit test. tc classification after a push keeps
working.

The kernel uses two conventions for skb->network_header when a packet
carries an in-band VLAN tag:

* network_header points at the L3 header
* network_header points at the in-band VLAN header

Since commit 938863727076 ("tc: adjust network header after 2nd vlan
push"), skb_vlan_push() uses the second convention when it pushes a
second tag. The flow dissector, and so tc flower, needs that layout to
classify the packet after the push. Drivers doing TSO or checksum
offload expect the first one. vlan_features_check() clears TSO for
multi-tagged packets, so most drivers fall back to software GSO, which
finds the L3 header itself. igb keeps TSO for these packets and reads
the IP header at skb->network_header, so it builds the TSO context from
the VLAN header and corrupts the packet. OVS set actions after a second
push write to the wrong header in the same way.

Which convention should a packet with in-band VLAN tags follow? This
series keeps the tc layout, converts to L3 in validate_xmit_skb() for
CHECKSUM_PARTIAL packets, and restores L3 right after the push in OVS.
If L3 should hold everywhere instead, the flow dissector would need to
find in-band tags from mac_len, and skb_vlan_push() could go back to
its old behavior.

We hit this in production with VLAN-tagged traffic forwarded by OVS out
of an igb NIC. The bug was actually triggered, not just found by
code inspection.

Link: https://bugzilla.proxmox.com/show_bug.cgi?id=8318

Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
---
Gabriel Goller (3):
      net: restore the L3 header before VLAN TX offload checks
      openvswitch: preserve the L3 header after stacked VLAN pushes
      net: test stacked VLAN headers before TX offloads

 net/core/dev.c                                     |  17 +++
 net/core/net_test.c                                | 145 +++++++++++++++++++++
 net/openvswitch/actions.c                          |   6 +-
 .../selftests/net/openvswitch/openvswitch.sh       |  34 +++++
 4 files changed, 201 insertions(+), 1 deletion(-)
---
base-commit: 8d5ce4751fad9499ea408163af7f410f18a85782
base-tree: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git main
change-id: 20261111-net_restore_the-59b5fb335fe3

Best regards,
--  
Gabriel Goller <g.goller@proxmox.com>