[SRU][J:linux-gcp/N:linux-gcp][PATCH v3 2/2] gve: fix zero-length skb frag with header-split

Rickey Castillo rickey.castillo.valenzuela at canonical.com
Fri Sep 11 01:03:05 UTC 2026


From: Jordan Rhee <jordanrhee at google.com>

BugLink: https://bugs.launchpad.net/bugs/2167032

When header split is enabled and a header-only packet is
received such as a pure TCP ACK, GVE will indicate an
RX SKB with a zero-length fragment. If this SKB is then
hairpinned and sent back out, the GVE TX path will emit
a zero-length descriptor. Hardware considers this
an illegal descriptor and stops the queue, causing a
TX timeout and interface reset.

Fix it by not adding the zero-length skb frag.

Cc: stable at vger.kernel.org
Fixes: 5e37d8254e7f ("gve: Add header split data path")
Suggested-by: Praveen Kaligineedi <pkaligineedi at google.com>
Co-developed-by: Ziwei Xiao <ziweixiao at google.com>
Signed-off-by: Ziwei Xiao <ziweixiao at google.com>
Signed-off-by: Jordan Rhee <jordanrhee at google.com>
Signed-off-by: Harshitha Ramamurthy <hramamurthy at google.com>
Link: https://patch.msgid.link/20260807224315.234152-2-hramamurthy@google.com
Signed-off-by: Jakub Kicinski <kuba at kernel.org>
(backported from commit 6bf14575c65569dcded90ef78afb8a6d57323f04)
[ijwhitfield: Adjusted context due to missing commit:
62d7f40503bc6 ("gve: support unreadable netmem")
Also changed gve_buffer_free to a call to gve_enqueue_buf_state to add
the buffer to a list of recycled buffers, essentially. This change was
needed because this kernel is missing:
ebdfae0d377b4 ("gve: adopt page pool for DQ RDA mode")
which adds gve_buffer_free in order to handle buffer freeing differently
when using new page pool behavior. Since we don't have that commit which
adds the page pool behavior, we can free the buffer the old way as was
done before the patch.]
Signed-off-by: Ian Whitfield <ian.whitfield at canonical.com>
Acked-by: Magali Lemes <magali.lemes at canonical.com>
Acked-by: Rickey Castillo <rickey.castillo.valenzuela at canonical.com>
Signed-off-by: Ian Whitfield <ian.whitfield at canonical.com>
[rickey.castillo: Cherry picked from linux-gke to linux-gcp]
Signed-off-by: Rickey Castillo <rickey.castillo.valenzuela at canonical.com>
---
 drivers/net/ethernet/google/gve/gve_rx_dqo.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
index e593563ef87a..8de1b97209e9 100644
--- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
@@ -812,6 +812,11 @@ static int gve_rx_dqo(struct napi_struct *napi, struct gve_rx_ring *rx,
 		rx->rx_hsplit_unsplit_pkt += unsplit;
 		rx->rx_hsplit_bytes += hdr_len;
 		u64_stats_update_end(&rx->statss);
+
+		if (!buf_len) {
+			gve_enqueue_buf_state(rx, &rx->dqo.recycled_buf_states, buf_state);
+			return 0;
+		}
 	}
 
 	/* Sync the portion of dma buffer for CPU to read. */
-- 
2.53.0




More information about the kernel-team mailing list