RE: [PATCH net v2] vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

[Jagielski, Jedrzej]

From: Harshaka Narayana <harshaka.narayana@xxxxxxxxxxxx> 
Sent: Thursday, July 9, 2026 9:47 PM

>vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the
>outer header, but for a Geneve-encapsulated packet the device can set
>them based on the inner header instead, signalled by the
>VMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the
>function never skips the outer encapsulation, this mismatch triggers:
>
>- BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP), because the outer
>  protocol is UDP (Geneve), not TCP.
>- BUG_ON(hdr.eth->h_proto != ...), when the tunnel's outer and inner
>  IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa).
>
>Check VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the
>function cannot locate the inner header it would need to parse. Also
>convert the remaining BUG_ON()s in this function to return 0
>defensively.
>
>Fixes: 45dac1d6ea04 ("vmxnet3: Changes for vmxnet3 adapter version 2 (fwd)")
>Signed-off-by: Harshaka Narayana <harshaka.narayana@xxxxxxxxxxxx>
>Signed-off-by: Ronak Doshi <ronak.doshi@xxxxxxxxxxxx>
>Signed-off-by: Sankararaman Jayaraman <sankararaman.jayaraman@xxxxxxxxxxxx>
>---
>v2:
>  - Check VMXNET3_RCD_HDR_INNER_SHIFT up front to catch the Geneve
>    inner-header case directly, and convert the remaining
>    BUG_ON(hdr.eth->h_proto != ...) checks to return 0
>  - Reworded commit message to describe the root cause via
>    VMXNET3_RCD_HDR_INNER_SHIFT
>v1: https://lore.kernel.org/netdev/20260707165248.1859188-1-harshaka.narayana@xxxxxxxxxxxx/
>---

now i see that i replayed on v1 but v2 is already there

when sending patches to netdev the rule is to wait at least
24h between submit ions - please be aware