[PATCH RFC net 1/3] net: restore the L3 header before VLAN TX offload checks

[Gabriel Goller <g.goller@proxmox.com>]

A second VLAN push leaves network_header pointing at an in-band VLAN
header. Drivers such as igb can interpret those bytes as an IP header
when preparing TSO and corrupt the packet.

Restore the L3 header before offload feature checks for VLAN-tagged
CHECKSUM_PARTIAL packets. Keep the generic skb_vlan_push() layout intact
because tc classification after a push depends on it.

This fix belongs in the common TX path because packets tagged by tc or
BPF do not pass through OVS actions. Keep it separate from the OVS fix:
OVS must preserve L3 before executing subsequent actions, including on
packets without checksum offload. TX validation cannot repair corruption
that has already occurred in an action, whether in OVS or tc.

validate_xmit_skb() also runs on noqueue upper devices such as bond,
team or macvlan. For CHECKSUM_PARTIAL packets tagged above such a
device, network_header then sits at L3 while skb->protocol is still a
VLAN type. The flow dissector parses the IP header as a VLAN header in
that state, which affects bond layer3+4 hashing and tc flower on the
lower device's egress. Bridged packets already get the same conversion
in br_dev_queue_push_xmit() since commit df356d5e81b0 ("bridge: Fix
network header pointer for vlan tagged packets").

The IPv4/IPv6 KUnit reproducer fails without this fix and passes with it.
All 22 enabled net_core KUnit cases and software tc_actions and tc_flower
tests pass in QEMU. Actual igb hardware TSO has not been tested.

Fixes: 938863727076 ("tc: adjust network header after 2nd vlan push")
Signed-off-by: Gabriel Goller <g.goller@proxmox.com>
---
 net/core/dev.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index 3c58db732761..fa47fe60b444 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4219,6 +4219,20 @@ static struct sk_buff *validate_xmit_skb(struct sk_buff *skb, struct net_device
 		     !(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST)))
 		skb->ip_summed = CHECKSUM_NONE;
 
+	/* VLAN actions may leave network_header at an in-band VLAN header.
+	 * Hardware checksum and segmentation offloads need the L3 header.
+	 */
+	if (skb->ip_summed == CHECKSUM_PARTIAL &&
+	    eth_type_vlan(skb->protocol)) {
+		int depth;
+
+		if (!vlan_get_protocol_and_depth(skb, skb->protocol, &depth))
+			goto out_unhandled_proto;
+
+		skb_set_network_header(skb, depth);
+		skb_reset_mac_len(skb);
+	}
+
 	features = netif_skb_features(skb);
 	skb = validate_xmit_vlan(skb, features);
 	if (unlikely(!skb))
@@ -4267,6 +4281,9 @@ static struct sk_buff *validate_xmit_skb(struct sk_buff *skb, struct net_device
 
 	return skb;
 
+out_unhandled_proto:
+	kfree_skb_reason(skb, SKB_DROP_REASON_UNHANDLED_PROTO);
+	goto out_null;
 out_kfree_skb:
 	kfree_skb(skb);
 out_null:

-- 
2.47.3