Commit 513e23857a3a for kernel

commit 513e23857a3a64fa73a1deb36a385eecd4ad7690
Author: Willem de Bruijn <willemb@google.com>
Date:   Wed Oct 7 13:57:30 2026 -0400

    net/packet: call packet_parse_headers after virtio_net_hdr_to_skb

    SOCK_RAW packet sockets incorrectly drop VLAN-tagged GSO packets
    without VIRTIO_NET_HDR_F_NEEDS_CSUM.

    packet_parse_headers() sets skb->protocol to VLAN but advances
    skb->network_header past the VLAN tags. virtio_net_hdr_to_skb()
    then flow dissects these packets, which parses the network header as a
    VLAN tag, and fails.

    Call packet_parse_headers() after virtio_net_hdr_to_skb() instead.

    This matches tun_get_user() and tap_get_user() and thus simplifies
    overall complexity.

    Commit 01fdecc0480d ("net: packet: fix wrong transport_header when
    sending VLAN-tagged frame") fixed the same issue for the transport
    header probe in packet_parse_headers(). That probe is now skipped if
    virtio_net_hdr_to_skb() already set the transport header, avoiding a
    redundant dissection.

    Implementation details:
    - Do not set skb->protocol to the RX wildcard ETH_P_ALL. SOCK_RAW then
      derives it from the link layer header, as before. SOCK_DGRAM now
      leaves it 0, or derives it from gso_type for GSO with NEEDS_CSUM.
    - Keep virtio_net_hdr_set_proto() last, so that the link layer protocol
      takes priority over gso_type.

    Reported-by: Junnan Zhang <zhangjn_dev@163.com>
    Closes: https://lore.kernel.org/netdev/20260821085722.24036-1-zhangjn_dev@163.com/
    Fixes: dfed913e8b55 ("net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO")
    Signed-off-by: Willem de Bruijn <willemb@google.com>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Link: https://patch.msgid.link/20261007175816.3138556-1-willemdebruijn.kernel@gmail.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 6ff16eef24f4..52ae3d875e97 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1943,8 +1943,7 @@ static void packet_parse_headers(struct sk_buff *skb, struct socket *sock)
 	/* On TX skb->data is the L2 header; anchor it for all socket types. */
 	skb_reset_mac_header(skb);

-	if ((!skb->protocol || skb->protocol == htons(ETH_P_ALL)) &&
-	    sock->type == SOCK_RAW)
+	if (!skb->protocol && sock->type == SOCK_RAW)
 		skb->protocol = dev_parse_header_protocol(skb);

 	skb_probe_transport_header(skb);
@@ -2614,7 +2613,8 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
 	struct page *page;
 	int err;

-	skb->protocol = proto;
+	if (proto != htons(ETH_P_ALL))
+		skb->protocol = proto;
 	skb->dev = dev;
 	skb->priority = sockc->priority;
 	skb->mark = sockc->mark;
@@ -2678,8 +2678,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
 	if (unlikely(!skb->len))
 		return -EINVAL;

-	packet_parse_headers(skb, sock);
-
 	return tp_len;
 }

@@ -2919,9 +2917,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 				tp_len = -EINVAL;
 				goto tpacket_error;
 			}
-			virtio_net_hdr_set_proto(skb, &vnet_hdr);
 		}

+		packet_parse_headers(skb, po->sk.sk_socket);
+
+		if (has_vnet_hdr)
+			virtio_net_hdr_set_proto(skb, &vnet_hdr);
+
 		uarg = kmalloc(sizeof(*uarg), GFP_KERNEL);
 		if (unlikely(!uarg)) {
 			if (likely(len_sum > 0))
@@ -3122,7 +3124,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 		goto out_free;
 	}

-	skb->protocol = proto;
+	if (proto != htons(ETH_P_ALL))
+		skb->protocol = proto;
 	skb->dev = dev;
 	skb->priority = sockc.priority;
 	skb->mark = sockc.mark;
@@ -3131,16 +3134,18 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 	if (unlikely(extra_len == 4))
 		skb->no_fcs = 1;

-	packet_parse_headers(skb, sock);
-
 	if (vnet_hdr_sz) {
 		err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le());
 		if (err)
 			goto out_free;
 		len += vnet_hdr_sz;
-		virtio_net_hdr_set_proto(skb, &vnet_hdr);
 	}

+	packet_parse_headers(skb, sock);
+
+	if (vnet_hdr_sz)
+		virtio_net_hdr_set_proto(skb, &vnet_hdr);
+
 	err = packet_xmit(po, skb);

 	if (unlikely(err != 0)) {