Patch "vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame" has been added to the 6.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     vmxnet3-fix-packet-corruption-in-vmxnet3_xdp_xmit_fr.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 11ec9887a59d5ccf110b089be326a65edd598a67
Author: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
Date:   Mon Oct 14 21:03:11 2024 +0200

    vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame
    
    [ Upstream commit 4678adf94da4a9e9683817b246b58ce15fb81782 ]
    
    Andrew and Nikolay reported connectivity issues with Cilium's service
    load-balancing in case of vmxnet3.
    
    If a BPF program for native XDP adds an encapsulation header such as
    IPIP and transmits the packet out the same interface, then in case
    of vmxnet3 a corrupted packet is being sent and subsequently dropped
    on the path.
    
    vmxnet3_xdp_xmit_frame() which is called e.g. via vmxnet3_run_xdp()
    through vmxnet3_xdp_xmit_back() calculates an incorrect DMA address:
    
      page = virt_to_page(xdpf->data);
      tbi->dma_addr = page_pool_get_dma_addr(page) +
                      VMXNET3_XDP_HEADROOM;
      dma_sync_single_for_device(&adapter->pdev->dev,
                                 tbi->dma_addr, buf_size,
                                 DMA_TO_DEVICE);
    
    The above assumes a fixed offset (VMXNET3_XDP_HEADROOM), but the XDP
    BPF program could have moved xdp->data. While the passed buf_size is
    correct (xdpf->len), the dma_addr needs to have a dynamic offset which
    can be calculated as xdpf->data - (void *)xdpf, that is, xdp->data -
    xdp->data_hard_start.
    
    Fixes: 54f00cce1178 ("vmxnet3: Add XDP support.")
    Reported-by: Andrew Sauber <andrew.sauber@xxxxxxxxxxxxx>
    Reported-by: Nikolay Nikolaev <nikolay.nikolaev@xxxxxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Tested-by: Nikolay Nikolaev <nikolay.nikolaev@xxxxxxxxxxxxx>
    Acked-by: Anton Protopopov <aspsk@xxxxxxxxxxxxx>
    Cc: William Tu <witu@xxxxxxxxxx>
    Cc: Ronak Doshi <ronak.doshi@xxxxxxxxxxxx>
    Link: https://patch.msgid.link/a0888656d7f09028f9984498cc698bb5364d89fc.1728931137.git.daniel@xxxxxxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/vmxnet3/vmxnet3_xdp.c b/drivers/net/vmxnet3/vmxnet3_xdp.c
index a6c787454a1ae..1341374a4588a 100644
--- a/drivers/net/vmxnet3/vmxnet3_xdp.c
+++ b/drivers/net/vmxnet3/vmxnet3_xdp.c
@@ -148,7 +148,7 @@ vmxnet3_xdp_xmit_frame(struct vmxnet3_adapter *adapter,
 	} else { /* XDP buffer from page pool */
 		page = virt_to_page(xdpf->data);
 		tbi->dma_addr = page_pool_get_dma_addr(page) +
-				VMXNET3_XDP_HEADROOM;
+				(xdpf->data - (void *)xdpf);
 		dma_sync_single_for_device(&adapter->pdev->dev,
 					   tbi->dma_addr, buf_size,
 					   DMA_TO_DEVICE);