net: reset transport_header for ndo_features_check

For CHECKSUM_PARTIAL skbs, validate_xmit_skb() resets
transport_header (inner_transport_header for encapsulated skbs)
from csum_start, but only after netif_skb_features() has called
ndo_features_check().

The hook can therefore see a transport_header left elsewhere by
the receive path, while ndo_start_xmit() sees the reset one. For
example, ip6_rcv_core() leaves it after the fixed header of
forwarded IPv6 packets with destination options or a routing
header, and seg6, rpl and ioam6 point it at the header they insert.

i40e_features_check() then bounds IPLEN with a 40 byte
skb_network_header_len(), while i40e_tx_enable_csum() programs the
real length, which can overflow the 7-bit field.

Move the reset before netif_skb_features(). Skbs that are not
segmented in software reach ndo_start_xmit() with the same headers
as before, and software GSO parses the headers itself. The exception
is encapsulated SKB_GSO_DODGY skbs that the device segments: their
inner_transport_header, which bpf_skb_adjust_room() or
bpf_lwt_push_ip_encap() may have copied from a stale
transport_header, now points at csum_start.

Signed-off-by: Matt Vollrath <redacted>
---
v2:
- Target net-next, drop Fixes and Cc: stable (Eric)
- Shorten the changelog (Eric)

v1: https://lore.kernel.org/all/20261104175517.2395704-1-tactii@gmail.com/
---
 net/core/dev.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 1aece2fe2429f..6fbd8a8884258 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c

@@ -4209,6 +4209,15 @@ static struct sk_buff *validate_xmit_skb(struct sk_buff *skb, struct net_device
 	if (unlikely(!skb))
 		goto out_null;
 
+	if (skb->ip_summed == CHECKSUM_PARTIAL) {
+		if (skb->encapsulation)
+			skb_set_inner_transport_header(skb,
+						       skb_checksum_start_offset(skb));
+		else
+			skb_set_transport_header(skb,
+						 skb_checksum_start_offset(skb));
+	}
+
 	features = netif_skb_features(skb);
 	skb = validate_xmit_vlan(skb, features);
 	if (unlikely(!skb))

@@ -4241,16 +4250,9 @@ static struct sk_buff *validate_xmit_skb(struct sk_buff *skb, struct net_device
 		 * support checksumming for this protocol, complete
 		 * checksumming here.
 		 */
-		if (skb->ip_summed == CHECKSUM_PARTIAL) {
-			if (skb->encapsulation)
-				skb_set_inner_transport_header(skb,
-							       skb_checksum_start_offset(skb));
-			else
-				skb_set_transport_header(skb,
-							 skb_checksum_start_offset(skb));
-			if (skb_csum_hwoffload_help(skb, features))
-				goto out_kfree_skb;
-		}
+		if (skb->ip_summed == CHECKSUM_PARTIAL &&
+		    skb_csum_hwoffload_help(skb, features))
+			goto out_kfree_skb;
 	}
 
 	skb = validate_xmit_xfrm(skb, features, again);

base-commit: 7b6ab4dbc156e2f96419715130b3d5738a306c93
-- 
2.43.0

Hello:

This patch was applied to netdev/net-next.git (main)
by Paolo Abeni [off-list ref]:

On Fri,  6 Nov 2026 12:29:25 -0500 you wrote:

For CHECKSUM_PARTIAL skbs, validate_xmit_skb() resets
transport_header (inner_transport_header for encapsulated skbs)
from csum_start, but only after netif_skb_features() has called
ndo_features_check().

The hook can therefore see a transport_header left elsewhere by
the receive path, while ndo_start_xmit() sees the reset one. For
example, ip6_rcv_core() leaves it after the fixed header of
forwarded IPv6 packets with destination options or a routing
header, and seg6, rpl and ioam6 point it at the header they insert.

[...]

Here is the summary with links:
  - [net-next,v2] net: reset transport_header for ndo_features_check
    https://git.kernel.org/netdev/net-next/c/f4564d298418

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html