Re: [PATCH net v3] vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

[Simon Horman]

On Mon, Jul 13, 2026 at 07:09:15AM -0700, Harshaka Narayana wrote:
> vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the
> outer header, but for a Geneve-encapsulated packet the device can set
> them based on the inner header instead, signalled by the
> VMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the
> function never skips the outer encapsulation, this mismatch triggers:
> 
> - BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP), because the outer
>   protocol is UDP (Geneve), not TCP.
> - BUG_ON(hdr.eth->h_proto != ...), when the tunnel's outer and inner
>   IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa).
> 
> Check VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the
> function cannot locate the inner header it would need to parse. Also
> convert the remaining BUG_ON()s in this function to return 0
> defensively.
> 
> Fixes: 45dac1d6ea04 ("vmxnet3: Changes for vmxnet3 adapter version 2 (fwd)")
> Signed-off-by: Harshaka Narayana <harshaka.narayana@xxxxxxxxxxxx>
> Reviewed-by: Ronak Doshi <ronak.doshi@xxxxxxxxxxxx>
> Reviewed-by: Sankararaman Jayaraman <sankararaman.jayaraman@xxxxxxxxxxxx>
> ---
> v3:
>   - Combined the two early return-0 checks into one condition
>   - Replaced stacked Signed-off-by tags with Reviewed-by for Ronak
>     Doshi and Sankararaman Jayaraman
> v2: https://lore.kernel.org/netdev/20260709201654.4108084-1-harshaka.narayana@xxxxxxxxxxxx/
>   - Check VMXNET3_RCD_HDR_INNER_SHIFT up front to catch the Geneve
>     inner-header case directly, and convert the remaining
>     BUG_ON(hdr.eth->h_proto != ...) checks to return 0
>   - Reworded commit message to describe the root cause via
>     VMXNET3_RCD_HDR_INNER_SHIFT
> v1: https://lore.kernel.org/netdev/20260707165248.1859188-1-harshaka.narayana@xxxxxxxxxxxx/

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>