On Tue, Nov 11, 2025 at 07:12:11PM +0800, Xuan Zhuo wrote:
> The commit be50da3e9d4a ("net: virtio_net: implement exact header length
> guest feature") introduces support for the VIRTIO_NET_F_GUEST_HDRLEN
> feature in virtio-net.
>
> This feature requires virtio-net to set hdr_len to the actual header
> length of the packet when transmitting, the number of
> bytes from the start of the packet to the beginning of the
> transport-layer payload.
>
> However, in practice, hdr_len was being set using skb_headlen(skb),
> which is clearly incorrect. This commit fixes that issue.
>
> Fixes: be50da3e9d4a ("net: virtio_net: implement exact header length guest
> feature")
> Signed-off-by: Xuan Zhuo <[email protected]>
> ---
> arch/um/drivers/vector_transports.c | 1 +
> drivers/net/tun_vnet.h | 4 ++--
> drivers/net/virtio_net.c | 9 +++++++--
> include/linux/virtio_net.h | 26 +++++++++++++++++++++-----
> net/packet/af_packet.c | 5 +++--
> 5 files changed, 34 insertions(+), 11 deletions(-)
>
> diff --git a/arch/um/drivers/vector_transports.c
> b/arch/um/drivers/vector_transports.c
> index 0794d23f07cb..03c5baa1d0c1 100644
> --- a/arch/um/drivers/vector_transports.c
> +++ b/arch/um/drivers/vector_transports.c
> @@ -121,6 +121,7 @@ static int raw_form_header(uint8_t *header,
> vheader,
> virtio_legacy_is_little_endian(),
> false,
> + false,
> 0
> );
>
> diff --git a/drivers/net/tun_vnet.h b/drivers/net/tun_vnet.h
> index 81662328b2c7..0d376bc70dd7 100644
> --- a/drivers/net/tun_vnet.h
> +++ b/drivers/net/tun_vnet.h
> @@ -214,7 +214,7 @@ static inline int tun_vnet_hdr_from_skb(unsigned int
> flags,
>
> if (virtio_net_hdr_from_skb(skb, hdr,
> tun_vnet_is_little_endian(flags), true,
> - vlan_hlen)) {
> + false, vlan_hlen)) {
> struct skb_shared_info *sinfo = skb_shinfo(skb);
>
> if (net_ratelimit()) {
> @@ -244,7 +244,7 @@ tun_vnet_hdr_tnl_from_skb(unsigned int flags,
>
> if (virtio_net_hdr_tnl_from_skb(skb, tnl_hdr, has_tnl_offload,
> tun_vnet_is_little_endian(flags),
> - vlan_hlen)) {
> + false, vlan_hlen)) {
> struct virtio_net_hdr_v1 *hdr = &tnl_hdr->hash_hdr.hdr;
> struct skb_shared_info *sinfo = skb_shinfo(skb);
>
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 0369dda5ed60..b335c88a8cd6 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -3317,9 +3317,13 @@ static int xmit_skb(struct send_queue *sq, struct
> sk_buff *skb, bool orphan)
> const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;
> struct virtnet_info *vi = sq->vq->vdev->priv;
> struct virtio_net_hdr_v1_hash_tunnel *hdr;
> - int num_sg;
> unsigned hdr_len = vi->hdr_len;
> + bool hdrlen_negotiated;
> bool can_push;
> + int num_sg;
> +
> + hdrlen_negotiated = virtio_has_feature(vi->vdev,
> + VIRTIO_NET_F_GUEST_HDRLEN);
>
> pr_debug("%s: xmit %p %pM\n", vi->dev->name, skb, dest);
>
> @@ -3339,7 +3343,8 @@ static int xmit_skb(struct send_queue *sq, struct
> sk_buff *skb, bool orphan)
> hdr = &skb_vnet_common_hdr(skb)->tnl_hdr;
>
> if (virtio_net_hdr_tnl_from_skb(skb, hdr, vi->tx_tnl,
> - virtio_is_little_endian(vi->vdev), 0))
> + virtio_is_little_endian(vi->vdev),
> + hdrlen_negotiated, 0))
> return -EPROTO;
>
> if (vi->mergeable_rx_bufs)
> diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
> index b673c31569f3..3cd8b2ebc197 100644
> --- a/include/linux/virtio_net.h
> +++ b/include/linux/virtio_net.h
> @@ -211,16 +211,15 @@ static inline int virtio_net_hdr_from_skb(const struct
> sk_buff *skb,
> struct virtio_net_hdr *hdr,
> bool little_endian,
> bool has_data_valid,
> + bool hdrlen_negotiated,
> int vlan_hlen)
Took me a while to figure out why does tun pass false here.
The reason is that this flag is really only dealing with guest
hdrlen. so how about guest_hdrlen to mirror spec
or if you like xmit_hdrlen?
> {
> memset(hdr, 0, sizeof(*hdr)); /* no info leak */
>
> if (skb_is_gso(skb)) {
> struct skb_shared_info *sinfo = skb_shinfo(skb);
> + u16 hdr_len;
>
> - /* This is a hint as to how much should be linear. */
> - hdr->hdr_len = __cpu_to_virtio16(little_endian,
> - skb_headlen(skb));
> hdr->gso_size = __cpu_to_virtio16(little_endian,
> sinfo->gso_size);
> if (sinfo->gso_type & SKB_GSO_TCPV4)
> @@ -231,6 +230,21 @@ static inline int virtio_net_hdr_from_skb(const struct
> sk_buff *skb,
> hdr->gso_type = VIRTIO_NET_HDR_GSO_UDP_L4;
> else
> return -EINVAL;
> +
> + if (hdrlen_negotiated) {
> + hdr_len = skb_transport_offset(skb);
> +
> + if (hdr->gso_type == VIRTIO_NET_HDR_GSO_UDP_L4)
> + hdr_len += sizeof(struct udphdr);
> + else
> + hdr_len += tcp_hdrlen(skb);
> + } else {
> + /* This is a hint as to how much should be linear. */
> + hdr_len = skb_headlen(skb);
> + }
> +
> + hdr->hdr_len = __cpu_to_virtio16(little_endian, hdr_len);
> +
> if (sinfo->gso_type & SKB_GSO_TCP_ECN)
> hdr->gso_type |= VIRTIO_NET_HDR_GSO_ECN;
> } else
> @@ -384,6 +398,7 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb,
> struct virtio_net_hdr_v1_hash_tunnel *vhdr,
> bool tnl_hdr_negotiated,
> bool little_endian,
> + bool hdrlen_negotiated,
> int vlan_hlen)
> {
> struct virtio_net_hdr *hdr = (struct virtio_net_hdr *)vhdr;
> @@ -395,7 +410,7 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb,
> SKB_GSO_UDP_TUNNEL_CSUM);
> if (!tnl_gso_type)
> return virtio_net_hdr_from_skb(skb, hdr, little_endian, false,
> - vlan_hlen);
> + hdrlen_negotiated, vlan_hlen);
>
> /* Tunnel support not negotiated but skb ask for it. */
> if (!tnl_hdr_negotiated)
> @@ -408,7 +423,8 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb,
>
> /* Let the basic parsing deal with plain GSO features. */
> skb_shinfo(skb)->gso_type &= ~tnl_gso_type;
> - ret = virtio_net_hdr_from_skb(skb, hdr, true, false, vlan_hlen);
> + ret = virtio_net_hdr_from_skb(skb, hdr, true, false, hdrlen_negotiated,
> + vlan_hlen);
> skb_shinfo(skb)->gso_type |= tnl_gso_type;
> if (ret)
> return ret;
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index 173e6edda08f..6982f4ab1c73 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -2093,7 +2093,8 @@ static int packet_rcv_vnet(struct msghdr *msg, const
> struct sk_buff *skb,
> return -EINVAL;
> *len -= vnet_hdr_sz;
>
> - if (virtio_net_hdr_from_skb(skb, (struct virtio_net_hdr *)&vnet_hdr,
> vio_le(), true, 0))
> + if (virtio_net_hdr_from_skb(skb, (struct virtio_net_hdr *)&vnet_hdr,
> + vio_le(), true, false, 0))
> return -EINVAL;
>
> return memcpy_to_msg(msg, (void *)&vnet_hdr, vnet_hdr_sz);
> @@ -2361,7 +2362,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct
> net_device *dev,
> if (vnet_hdr_sz &&
> virtio_net_hdr_from_skb(skb, h.raw + macoff -
> sizeof(struct virtio_net_hdr),
> - vio_le(), true, 0)) {
> + vio_le(), true, false, 0)) {
> if (po->tp_version == TPACKET_V3)
> prb_clear_blk_fill_status(&po->rx_ring);
> goto drop_n_account;
> --
> 2.32.0.3.g01195cf9f
