Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2218665/?format=api
{ "id": 2218665, "url": "http://patchwork.ozlabs.org/api/patches/2218665/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/tencent_4A3E1C339C75D359093BE4F08648AFAA6009@qq.com/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<tencent_4A3E1C339C75D359093BE4F08648AFAA6009@qq.com>", "list_archive_url": null, "date": "2026-04-01T15:38:57", "name": "[net] ipvs: fix MTU check for GSO packets in tunnel mode", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "037915190e9fb5da0cbc3738af14b6bc4196f203", "submitter": { "id": 93032, "url": "http://patchwork.ozlabs.org/api/people/93032/?format=api", "name": "Yingnan Zhang", "email": "342144303@qq.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/tencent_4A3E1C339C75D359093BE4F08648AFAA6009@qq.com/mbox/", "series": [ { "id": 498356, "url": "http://patchwork.ozlabs.org/api/series/498356/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=498356", "date": "2026-04-01T15:38:57", "name": "[net] ipvs: fix MTU check for GSO packets in tunnel mode", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/498356/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2218665/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2218665/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-11568-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=qq.com header.i=@qq.com header.a=rsa-sha256\n header.s=s201512 header.b=x+7tO0Fo;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c15:e001:75::12fc:5321; helo=sin.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11568-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=\"x+7tO0Fo\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=162.62.57.87", "smtp.subspace.kernel.org;\n dmarc=pass (p=quarantine dis=none) header.from=qq.com", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=qq.com" ], "Received": [ "from sin.lore.kernel.org (sin.lore.kernel.org\n [IPv6:2600:3c15:e001:75::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fm8qb6Xp7z1yCp\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 02 Apr 2026 03:01:31 +1100 (AEDT)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id 77645308D639\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 1 Apr 2026 15:39:44 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 415743D3302;\n\tWed, 1 Apr 2026 15:39:42 +0000 (UTC)", "from out162-62-57-87.mail.qq.com (out162-62-57-87.mail.qq.com\n [162.62.57.87])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 60EA12DB795;\n\tWed, 1 Apr 2026 15:39:37 +0000 (UTC)", "from CGG7X9MGDG.corp.ebay.com ([216.113.165.51])\n\tby newxmesmtplogicsvrszb51-1.qq.com (NewEsmtp) with SMTP\n\tid 9C4B5ED3; Wed, 01 Apr 2026 23:39:04 +0800" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1775057981; cv=none;\n b=BxBaVX4nNrbK22azVIdgu5ZORPNbvPHEKUNsGfbm5U5Ms0jlMGB7sDv2cTidUsWXCW6v4vOJmNhIphsWPRT8SeUoZpLmZdDO0o69zZ7y4+Xgxjy9BDdy0DRIBD/HNO9WM4bXkItso5HRT4hB11IfFE5ZrabfXwoM4pmxmMOgdP0=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1775057981; c=relaxed/simple;\n\tbh=Mu6hKdatik9ZMJJtwZgql98CyxOVff4TkwCo1o6/JaU=;\n\th=Message-ID:From:To:Cc:Subject:Date:MIME-Version;\n b=KjgEPnGvn2oKQwgrjtZoHlLKOjejOIZT2R0EXWfvIi31mgpRCehvLhPj3iMngLz3ujponlIRKIvvOfarRgSBYL+q2HAUvFkhcQfU2C8YmfuKaWdjx9rNNk0YdZYbvVPavABSGBioncl0Aow2b0vOE5QI+CFkxAl9YJp43KY0+fA=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=quarantine dis=none) header.from=qq.com;\n spf=pass smtp.mailfrom=qq.com;\n dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=x+7tO0Fo;\n arc=none smtp.client-ip=162.62.57.87", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512;\n\tt=1775057967; bh=rWJTDXtf7btF2BKyo9SNlIT4oe/5A/4pOHharg1NEmk=;\n\th=From:To:Cc:Subject:Date;\n\tb=x+7tO0FoLpxjqsY/zR56hqlfGhqT1xUE3QQ1ZIZJRhfFd1loPrac2fAZqM+0CPSHX\n\t ntR1MRCBiFMbyC9/RP0Yf6xYeOhbnZgOPdNIyopq4qIwVBfku0aysnapkDmQga5Grr\n\t HgrI6n9N/L3/smfoQugDAI4vufiRItPmGMZdKcII=", "X-QQ-mid": "xmsmtpt1775057944te0b7xgb9", "Message-ID": "<tencent_4A3E1C339C75D359093BE4F08648AFAA6009@qq.com>", "X-QQ-XMAILINFO": "Nx5J06Esz7r7L/P7JjrRw2OQ96/QQu1sjbUpPUf/S8cXgzPtZ2f3uIQXACb/wH\n\t tkBJeAETqlzjuQtZCE0raxVeHmg/LJvlmUiZDn/Boir0G+gJ3OlTulAoVCT6QO7DtdodPaajMaKg\n\t D5wGUhVZyYLbOTN7VE+nuLm1ZKHVOXANNAW6iGarRWoeVBz4qee0/yT+E3jw/G9nU7GJAT0v5E32\n\t pfk9IW+EWV24WJmHsYceb/lYWrqXPxEyxsWDl4VvY5LfqAAkX5SR9jAk+hgs13LP8UPTA/XDyAdx\n\t 6bwbi0bTHLCZJcSD8kx6Z3HSiyCSUrrUCpMgj5aTq6MkZIY8DiUkhWPiM4U3kiyGYP+PHt078GP/\n\t kcKCbfIaIEiVTRdyXPQUdLkQt6TshFYagr01HY34NIZrX/X57T0NuKwAIS4iiTPUIWslSaXetyLJ\n\t ytole5zgpB7SEKs4ntKkG6BTMPkOcDu4MdJmDjib3Ow0/vg3xsJmscXucSMZ4o0PB491CNqJ2Y50\n\t QMqUv8pkNrWm5TT0TCyetLKVjPwgl3zidyxwWJI/PuNsjz6oDSPxpkMlpFswhikn9ZlmBJjCGWRL\n\t x9V0qyMckigOAn+pQxtiXVUW8+Kjwkoi+aay8v1LzP/8T7N/A8WjfzfZPN3B5fCP84SW+Geaf0Cx\n\t Bd7SMYRb+mn7WuKcnEZ/hK9tislZgKNIyjfOQHVCnzKxyzn/9xQKS2FpPex90ADwcO1gHaBe7kxR\n\t L53clAF12YSHsSfazgbcCwq3TH4LUB/2WKjmn3g3I7A0dHnlY2TlH4k8fgCnVXBMXoDnlBztkOfN\n\t HZm/vl1LlFMCV/QnM2bkenDwQUusjIZIviVjCxj0M/vYPsrI0NmVu8vYZ4z+DHOrmWBtfU03vVRy\n\t S8x5Km4lqWhFJj3CWBcAYoif1OQYHuNVd+ZOMb+1ZTalNALCNPzN4nktswa6+FWM25GCXCrpl+0O\n\t NniofjFa+TWNOHuYtshq5e8sHmwq507U7ZOcGzr+2+0uRJvymYHpKz73t4YWj+", "X-QQ-XMRINFO": "Mp0Kj//9VHAxzExpfF+O8yhSrljjwrznVg==", "From": "Yingnan Zhang <342144303@qq.com>", "To": "horms@verge.net.au,\n\tja@ssi.bg", "Cc": "pablo@netfilter.org,\n\tfw@strlen.de,\n\tphil@nwl.cc,\n\tdavem@davemloft.net,\n\tedumazet@google.com,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\tnetdev@vger.kernel.org,\n\tlvs-devel@vger.kernel.org,\n\tnetfilter-devel@vger.kernel.org,\n\tcoreteam@netfilter.org,\n\tlinux-kernel@vger.kernel.org,\n\tYingnan Zhang <342144303@qq.com>", "Subject": "[PATCH net] ipvs: fix MTU check for GSO packets in tunnel mode", "Date": "Wed, 1 Apr 2026 23:38:57 +0800", "X-OQ-MSGID": "<20260401153857.31562-1-342144303@qq.com>", "X-Mailer": "git-send-email 2.51.0", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "Currently, IPVS skips MTU checks for GSO packets by excluding them with\nthe !skb_is_gso(skb) condition. This creates problems when IPVS tunnel\nmode encapsulates GSO packets with IPIP headers.\n\nThe issue manifests in two ways:\n\n1. MTU violation after encapsulation:\n When a GSO packet passes through IPVS tunnel mode, the original MTU\n check is bypassed. After adding the IPIP tunnel header, the packet\n size may exceed the outgoing interface MTU, leading to unexpected\n fragmentation at the IP layer.\n\n2. Fragmentation with problematic IP IDs:\n When net.ipv4.vs.pmtu_disc=1 and a GSO packet with multiple segments\n is fragmented after encapsulation, each segment gets a sequentially\n incremented IP ID (0, 1, 2, ...). This happens because:\n\n a) The GSO packet bypasses MTU check and gets encapsulated\n b) At __ip_finish_output, the oversized GSO packet is split into\n separate SKBs (one per segment), with IP IDs incrementing\n c) Each SKB is then fragmented again based on the actual MTU\n\n This sequential IP ID allocation differs from the expected behavior\n and can cause issues with fragment reassembly and packet tracking.\n\nFix this by removing the GSO packet exception from the MTU check and\nproperly validating GSO packets using skb_gso_validate_network_len().\nThis function correctly validates whether the GSO segments will fit\nwithin the MTU after segmentation. If validation fails, send an ICMP\nFragmentation Needed message to enable proper PMTU discovery.\n\nFixes: 4cdd34084d53 (\"netfilter: nf_conntrack_ipv6: improve fragmentation handling\")\nSigned-off-by: Yingnan Zhang <342144303@qq.com>\n---\n net/netfilter/ipvs/ip_vs_xmit.c | 9 ++++++++-\n 1 file changed, 8 insertions(+), 1 deletion(-)", "diff": "diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c\nindex 3601eb86d..82f2e7a32 100644\n--- a/net/netfilter/ipvs/ip_vs_xmit.c\n+++ b/net/netfilter/ipvs/ip_vs_xmit.c\n@@ -232,8 +232,15 @@ static inline bool ensure_mtu_is_adequate(struct netns_ipvs *ipvs, int skb_af,\n \t\t\treturn true;\n \n \t\tif (unlikely(ip_hdr(skb)->frag_off & htons(IP_DF) &&\n-\t\t\t skb->len > mtu && !skb_is_gso(skb) &&\n+\t\t\t skb->len > mtu &&\n \t\t\t !ip_vs_iph_icmp(ipvsh))) {\n+\t\t\tif (skb_is_gso(skb)) {\n+\t\t\t\tif (skb_gso_validate_network_len(skb, mtu))\n+\t\t\t\t\treturn true;\n+\t\t\t\ticmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));\n+\t\t\t\tIP_VS_DBG(1, \"frag needed for %pI4\\n\", &ip_hdr(skb)->saddr);\n+\t\t\t\treturn false;\n+\t\t\t}\n \t\t\ticmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,\n \t\t\t\t htonl(mtu));\n \t\t\tIP_VS_DBG(1, \"frag needed for %pI4\\n\",\n", "prefixes": [ "net" ] }