# Re: \[PATCH net v3 2/8\] net: virtio: do not use dev-\>type to find the outer L3 header

- From: Eric Dumazet \<edumazet@kernel.org\>
- Date: 2026-11-06 09:56:03 
- List: netdev
- Page: https://ratatoskr.run/netdev/2026/11/17877148
- Thread: https://ratatoskr.run/netdev/2026/11/17870111/t.md

```text
Le ven. 6 nov. 2026 à 10:28, Michael S. Tsirkin [ref] a écrit :
>
> On Thu, Nov 05, 2026 at 12:57:09PM +0100, Eric Dumazet wrote:
> > virtio_net_l3_start() decides from skb->dev->type whether the frame
> > starts with an Ethernet header. tun decides it from the IFF_TAP and
> > IFF_TUN flags, and TUNSETLINK can set the type of a down tun device
> > to any value, without changing the flags.
> >
> > On an IFF_TAP device set to ARPHRD_NONE, the outer protocol checks
> > look at the IP header at the network header (ETH_HLEN), and never read
> > the Ethernet header. eth_type_trans() then sets skb->protocol from an
> > unchecked h_proto, for instance ETH_P_NSH, and the packet can reach
> > the skb_under_panic() addressed by the previous patch.
> >
> > On an IFF_TUN device set to ARPHRD_ETHER, the checks validate an
> > Ethernet header that tun then treats as the start of the L3 header.
> >
> > Checking in tun that the device type matches the framing is not
> > enough: the type is read again later, and a concurrent TUNSETLINK can
> > change it in between, since tun_get_user() only drops packets of a
> > down device after these checks.
> >
> > Add a has_eth argument to virtio_net_hdr_tnl_to_skb(), passed down to
> > virtio_net_l3_start(), so the device type is no longer used:
> >
> > - virtio_net always receives Ethernet frames.
> > - tun_get_user() passes whether the device is IFF_TAP.
> > - tun_xdp_one() always calls eth_type_trans() on its frames.
> >
> > Fixes: 288f30435132 ("tun: enable gso over UDP tunnel support.")
> > Reported-by: Sashiko <sashiko-bot@kernel.org>
> > Closes: https://lore.kernel.org/netdev/sashiko-outbox-198573@kernel.org/
> > Link: https://lore.kernel.org/netdev/179387332014.488856.9111956413610107951@kernel.org/
> > Signed-off-by: Eric Dumazet <edumazet@kernel.org>
>
> Acked-by: Michael S. Tsirkin <mst@redhat.com>

Sorry, I saw this reply too late, I sent v4 without it.
```