From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=103.168.172.137 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794452857; b=3HQbZKEp6YWeHP0rtkFyolF/krwLRsPs4CL1yLkSp47Yr4g8BzovLUNi+mcrzGN2jQuq LFU72Wf2eG0nR3IciTYpVQRklLeymkUbQV1USq4nHBbbAogttcC6NFm/Of/xuXR95dt5g swjH0lBevzTYZMxpzKWFbh3+jdXnXvMg5JlXEHH7zN3teBPIQhH8S/xPbi5GPJSoU7yxM e47ZnydRwQdikFHC5Go1vnTETbXIhR/vxy18TTzOtIfn7Bo1QGpesLgRWNs7EawhuEUO2 d8/PZ9CI5Hoc/W/mSxe0DnXezuHFbIN3UPpu3GUzVY9Id/+HRb9VirEVXsPlhvhDBAA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794452857; h=DMARC-Filter:Received:Received:DKIM-Signature:DKIM-Signature: X-DKIM2-Info:DKIM2-Signature:X-DKIM2-Info:Message-Instance: X-ME-Sender:X-ME-Received:X-ME-Proxy-Cause:X-ME-Proxy:Feedback-ID: Received:From:To:Cc:Subject:Date:Message-ID:X-Mailer:In-Reply-To: References:MIME-Version:Content-Transfer-Encoding; bh=W4w+LR0grSfC0O6TJwPlVRz1HHrBafoWQKAdK1CwzPg=; b=qCb3Xwm7qQbyQKSadt+rkt8XgulOZQWug9iKY03ODCygEptwhuT7P+3BZXcM+kJ1zKAz /qahGUghSVjwSMLk18TNYun91dQB3u+klX/oqOp1BeobenuKRtg24HIUAHFCWBRaAPjcP DJ9jc43E3tIEZBVH0kGv33ivntgXuQ4sxZvfp0OxO6bl+Nvmeuy3rxk2MfFgqC9/CF8Ow YAjeW+wX5X0dZqTGKF8vGCQ5+HmURr5ntjV97ySOFTzTDiorpXHgZU8JJvS5Yn6gdvguN k1FEtG8ZO1QVThbeDpOpWlc1y8nnn9rwFFe+KEc7GjLxWq4LBRgbMVqe33tVflTkhKg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none header.from=fryer.io; spf=pass smtp.mailfrom=fryer.io; dkim=pass header.d=fryer.io header.i=@fryer.io header.a=rsa-sha256 header.s=fm2 header.b=NZ69qV2i; dkim=pass header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm3 header.b=Wzgwxjq+; arc=none smtp.remote-ip=103.168.172.137 Received: from flow-a2-smtp.messagingengine.com (flow-a2-smtp.messagingengine.com [103.168.172.137]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9BE5C606A321 for ; Thu, 12 Nov 2026 03:07:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 9BE5C606A321 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=fryer.io Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=fryer.io Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=fryer.io header.i=@fryer.io header.a=rsa-sha256 header.s=fm2 header.b=NZ69qV2i; dkim=pass (2048-bit key, unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm3 header.b=Wzgwxjq+ Received: from phl-compute-03.internal (phl-compute-03.internal [10.202.2.43]) by mailflow.phl.internal (Postfix) with ESMTP id E1D571381053 for ; Wed, 11 Nov 2026 22:07:35 -0500 (EST) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-03.internal (MEProxy); Wed, 11 Nov 2026 22:07:35 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fryer.io; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm2; t=1794452855; x= 1794460055; bh=W4w+LR0grSfC0O6TJwPlVRz1HHrBafoWQKAdK1CwzPg=; b=N Z69qV2iBvajp6deZIzmDmrygTctOQ+PZaEm8XxAjWNW+Z5my/K+nbfRmfzN3dabe Qmb910svAoG8+Li+8P1QLX0iqPZuBuOzLtxwqhfvei1jqrzVmGnTdUY4xrkN9EWY ooqg39XKXxaIXPt/4kT1MxcxO2ncsX1w7iERYAAcEjzztQ4nVuCeJzVNEV+I7WCX gXSbC5dF2NTymyw0Ihi9/s3B1HYaV4+SFyYz67bZpcCH7P0f0syrH22ml3WHRRUB o1yoLyd0gT/tu3N1DlymIxAXl6CGhT9h3KaCHC3RwbEReJF/Zyx1FXGI0FqayF/G sGpEu4CmAREsltr7C1GSw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1794452855; x=1794460055; bh=W 4w+LR0grSfC0O6TJwPlVRz1HHrBafoWQKAdK1CwzPg=; b=Wzgwxjq+ChCgZXSCY y4rnZNsh1BFCqrWGSBuertcLV3Ib8tk+Aj6HQg4N6simXNtIIx6aAuDv684NxKx4 JzGINmYKC0AdKMDKkdri6S6GoIiKKihiIjqmDE/1U6Shspymz7SnEriodSAmDCrw qvfuKUgW0o57gQTqozieaYUGWj0s6TVRJA3vdH1XZ9HLUhngv2jtzHZ1u4zuQKwx uquMwXeAbURc3kS9/2H6LLH6bPaGWOtq/5KYwbvyRbi72GUAjDz9TYxrTC5nHZ0m 6+29twJYA9kSp0NXuhS7vxpIsphxEFleVAuj7dC15+hPisReoqduFGZ1nPAuDcLk DuBeg== X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-09; repo=github.com/dkim2wg/interop; date=2026-11-03; sw=lmtpprox; action=sign d=fryer.io a=rsa-sha256; DKIM2-Signature: i=1; m=1; t=1794452855; d=fryer.io; mf=PGJyeW9uQGZyeWVyLmlvPg==; rt=PGxpbnV4LWtlcm5lbEB2Z2VyLmtlcm5lbC5vcmc+; s=fm2:rsa-sha256:LybBjvj3XMFlt4Xa8Iinz9IdZ/MBI18T5QsUtAuCeQUhX9r P4o0+6k+kbdQTpEXAJ4zcGU0swXedl//mcWVTWdtbVf5t0tGudQAu1jgYrifc34T sGaKt4jK/1CXm15o8wB9K2oLE9K1+T32x7XQGlI78b4mbZ1N7pkq4scycQuNYy13 o225XXQ8K+mMrCtWHs8w4eYDqDWpzJexhk+HMj84YxXQnS9/RJXUhXsqPNL8q41b MGWTLvotkvqHXb2fYWoSan4+MoEVGtyGEx1x3KIl/LelL6Dc/EFKkP3ahZooBXB0 QOxwkr+RKM+GsUNyipmHNAJYIbRlCyeIpezaWjg==; X-DKIM2-Info: draft=ietf-dkim-dkim2-spec-09; repo=github.com/dkim2wg/interop; date=2026-11-03; sw=lmtpprox; action=mi-m=1; hc=11; hn=cc,content-transfer-encoding,date,feedback-id,from, in-reply-to,message-id,mime-version,references,subject,to; Message-Instance: m=1; h=sha256:k7wPwrYvyvpzLNZ/0y5EIsU/XZqYq5/Nju5XaWsrbCM=:JBc6KQ6IxtrqHD9mNQnOsmUcoTqyjMBA085J5ndHNr8=; X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTGn4y472hwTpe0VefQ9vF6vjRs+S6AXwSoOWMbjiC/uZXq2edNbyg2XuH2GbZoVEn Mfc3dHq/e16zcvkdgOotSr2vncmijHIlb5c/sbSEhrNX5JLVzUK1MiRHjeBC1RWX2P7BNt P0xzYOJOD7ntazzpmUzSnTj6raAPUGDWbljxtqbtDN8hq92xEvBPfJH3EQES5jyGjh6mqE 2QjOLhd+/a5qWNQ17PxOpwiD14xyDv//jdxKoBFGf5YslEWcSqSzIJGYGVcVEyLS47SUWI 8TJldhvRJM8LegqWRKxABWK47qwvdsIlpEUL32KXFNQUqi9qGq6bv4+q3Nd5faq1+QpWUA 3fuIPW7oVrKrdwGx/6b93cQ11NmSeABuPUHsGv/9UTyofd3Y3KYhhRSXCHjsGPr+R732mT KJXL6h0/P5Lxh0Mn/dp4bLUgxV8ekMnoWjKuJreKLVRIbvj8oSltNTtD2ff82rb7xz047g px7DdGKmioasVPku3jXv897VcZBdYkgjeRgHcrETwBX/O87rXxL/V7A6cF/MbRp5Dhj2QM 3AvjNIawgxlpKk2EhHeN3QwZY2ngeYlS4qgFlmH8ZZs/11YMhZE59Il+QjsyHtSYRMSbe1 pT/CqMoULKWE4bUJEWnnNYrtUlEZZ3N0NwOQCMlGSy78ZYK/tOdspeRloBXQ X-ME-Proxy: Feedback-ID: if1c946a5:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 11 Nov 2026 22:07:35 -0500 (EST) From: Bryon Fryer To: netdev@vger.kernel.org Cc: davem@davemloft.net, edumazet@kernel.org, horms@kernel.org, jasowangio@gmail.com, kuba@kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, pabeni@redhat.com, shuah@kernel.org, stable@vger.kernel.org Subject: [PATCH net 1/2] udp: restore outer transport header after tunnel GRO Date: Wed, 11 Nov 2026 22:07:07 -0500 Message-ID: <20261112030708.1915665-2-bryon@fryer.io> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261112030708.1915665-1-bryon@fryer.io> References: <20261112030708.1915665-1-bryon@fryer.io> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit UDP tunnel GRO can produce invalid virtio tunnel headers, causing virtio-net to drop whole aggregates. Losing several TCP segments at once causes retransmissions and can collapse throughput. Observed as slow VXLAN TCP traffic with kernel logs reporting dropped packets. Reproduced with ordinary tunnel traffic in disposable VMs. The unpatched reproductions required no kernel modifications or error injection. Inner GRO processing moves skb->transport_header to inner TCP or UDP. The inner completion callback saves it in inner_transport_header, but udp_gro_complete() leaves the main transport header there too. The virtio tunnel exporter added by commit a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.") treats that field as the outer UDP location. The exported outer header then appears after the inner network header, so the receiver rejects the descriptor. Restore skb->transport_header from nhoff after successful inner completion. This parsed outer UDP offset retains the inner transport and checksum offsets without assuming fixed header lengths. Tested under virtme-ng with socat sending bulk TCP over IPv4 VXLAN and Geneve between network namespaces. A raw sender TAP supplies wire-sized packets to a TAP/bridge path with ingress GRO. Exported virtio headers are relayed unchanged to a receiving TAP using the shared virtio decoder. Kernels used the same base, config and toolchain under KVM. For 32 MiB, median transfer times and rejected aggregates across three paired runs were: Before patch After patch VXLAN, GRO on 69.8s, 1418 rejects 0.15s, 0 rejects Geneve, GRO on 70.8s, 1414 rejects 0.16s, 0 rejects VXLAN, GRO off 0.22s, 0 rejects 0.23s, 0 rejects Geneve, GRO off 0.23s, 0 rejects 0.21s, 0 rejects Rejections are receiving TAP writes returning -EINVAL. Median TCP retransmissions fell from 2852 (VXLAN) and 2854 (Geneve) to zero. Every transfer verified all payload bytes; no TAP queue drops occurred. Separate eight-packet tests measured these outer UDP offsets, in bytes from the Ethernet frame start: TAP-exported outer_th_offset Actual UDP Before patch After patch VXLAN over IPv4 34 84 34 VXLAN-GPE over IPv4 34 70 34 Geneve over IPv4 34 84 34 The inner network and checksum-start offsets were unchanged. The accompanying TUN regression fails only its outer-offset assertion before patching and passes afterward. Selected existing TUN and UDP GSO selftests also passed before and after patching. VXLAN-GPE raw-TAP/GRO-on software segmentation still returns -EINVAL before and after this patch. This is a separate issue. Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.") Cc: stable@vger.kernel.org Signed-off-by: Bryon Fryer --- net/ipv4/udp_offload.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index b77ae2f00c..1a1d1a125d 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -948,6 +948,8 @@ int udp_gro_complete(struct sk_buff *skb, int nhoff, skb->encapsulation = 1; err = udp_sk(sk)->gro_complete(sk, skb, nhoff + sizeof(struct udphdr)); + if (!err) + skb_set_transport_header(skb, nhoff); } else { err = udp_gro_complete_segment(skb); } -- 2.47.3