On 9/19/24 10:44 AM, Willem de Bruijn wrote:

quoted

Yes, it seems that VRF calls dev_queue_xmit_nit without the same BH
protections that it expects.

I suspect that the fix is in VRF, to disable BH the same way that
__dev_queue_xmit does, before calling dev_queue_xmit_nit.

commit 504fc6f4f7f681d2a03aa5f68aad549d90eab853 removed the bh around
dev_queue_xmit_nit:

diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 6043e63b42f9..43f374444684 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c

@@ -638,9 +638,7 @@ static void vrf_finish_direct(struct sk_buff *skb)
                 eth_zero_addr(eth->h_dest);
                 eth->h_proto = skb->protocol;

-               rcu_read_lock_bh();
                 dev_queue_xmit_nit(skb, vrf_dev);
-               rcu_read_unlock_bh();

                 skb_pull(skb, ETH_HLEN);
         }