tcp_vu_hdrlen() returns a length that includes VNET_HLEN (the virtio net header), but vu_pad() expects the Layer-2 frame length, which should not include the virtio header. Passing the inflated length means short frames aren't padded to the minimum 60-byte Ethernet frame size (ETH_ZLEN). Subtract VNET_HLEN from hdrlen when computing the l2 length passed to vu_pad() in both tcp_vu_send_flag() and tcp_vu_data_from_sock(). Fixes: 0cb8f9003654 ("tcp, udp: Pad batched frames for vhost-user modes to 60 bytes (802.3 minimum)") Signed-off-by: Laurent Vivier --- tcp_vu.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/tcp_vu.c b/tcp_vu.c index 3847a4e92087..2c9ddba0c9a4 100644 --- a/tcp_vu.c +++ b/tcp_vu.c @@ -71,8 +71,8 @@ int tcp_vu_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags) { struct vu_dev *vdev = c->vdev; struct vu_virtq *vq = &vdev->vq[VHOST_USER_RX_QUEUE]; - size_t optlen, hdrlen; struct vu_virtq_element flags_elem[2]; + size_t optlen, hdrlen, l2len; struct ipv6hdr *ip6h = NULL; struct iphdr *ip4h = NULL; struct iovec flags_iov[2]; @@ -137,7 +137,8 @@ int tcp_vu_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags) tcp_fill_headers(c, conn, eh, ip4h, ip6h, th, &payload, NULL, seq, !*c->pcap); - vu_pad(&flags_elem[0].in_sg[0], hdrlen + optlen); + l2len = optlen + hdrlen - VNET_HLEN; + vu_pad(&flags_elem[0].in_sg[0], l2len); if (*c->pcap) pcap_iov(&flags_elem[0].in_sg[0], 1, VNET_HLEN); @@ -446,6 +447,7 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) int buf_cnt = head[i + 1] - head[i]; ssize_t dlen = iov_size(iov, buf_cnt) - hdrlen; bool push = i == head_cnt - 1; + size_t l2len; vu_set_vnethdr(vdev, iov->iov_base, buf_cnt); @@ -457,7 +459,8 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) tcp_vu_prepare(c, conn, iov, buf_cnt, &check, !*c->pcap, push); /* Pad first/single buffer only, it's at least ETH_ZLEN long */ - vu_pad(iov, dlen + hdrlen); + l2len = dlen + hdrlen - VNET_HLEN; + vu_pad(iov, l2len); if (*c->pcap) pcap_iov(iov, buf_cnt, VNET_HLEN); -- 2.53.0

On Mon, 23 Feb 2026 15:10:26 +0100 Laurent Vivier wrote:

tcp_vu_hdrlen() returns a length that includes VNET_HLEN (the virtio net header),

No need for this patch/series but: /** * tcp_vu_hdrlen() - return the size of the header in level 2 frame (TCP) * @v6: Set for IPv6 packet * * Return: return the size of the header */ ...can you fix that at some point? :) It's really not clear what it returns. I assumed "level 2" meant Layer-2 length (802.3-like), without virtio-net stuff, hence this issue.

but vu_pad() expects the Layer-2 frame length, which should not include the virtio header. Passing the inflated length means short frames aren't padded to the minimum 60-byte Ethernet frame size (ETH_ZLEN).

Subtract VNET_HLEN from hdrlen when computing the l2 length passed to vu_pad() in both tcp_vu_send_flag() and tcp_vu_data_from_sock().

Fixes: 0cb8f9003654 ("tcp, udp: Pad batched frames for vhost-user modes to 60 bytes (802.3 minimum)") Signed-off-by: Laurent Vivier --- tcp_vu.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/tcp_vu.c b/tcp_vu.c index 3847a4e92087..2c9ddba0c9a4 100644 --- a/tcp_vu.c +++ b/tcp_vu.c @@ -71,8 +71,8 @@ int tcp_vu_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags) { struct vu_dev *vdev = c->vdev; struct vu_virtq *vq = &vdev->vq[VHOST_USER_RX_QUEUE]; - size_t optlen, hdrlen; struct vu_virtq_element flags_elem[2]; + size_t optlen, hdrlen, l2len; struct ipv6hdr *ip6h = NULL; struct iphdr *ip4h = NULL; struct iovec flags_iov[2]; @@ -137,7 +137,8 @@ int tcp_vu_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags) tcp_fill_headers(c, conn, eh, ip4h, ip6h, th, &payload, NULL, seq, !*c->pcap);

- vu_pad(&flags_elem[0].in_sg[0], hdrlen + optlen); + l2len = optlen + hdrlen - VNET_HLEN; + vu_pad(&flags_elem[0].in_sg[0], l2len);

if (*c->pcap) pcap_iov(&flags_elem[0].in_sg[0], 1, VNET_HLEN); @@ -446,6 +447,7 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) int buf_cnt = head[i + 1] - head[i]; ssize_t dlen = iov_size(iov, buf_cnt) - hdrlen; bool push = i == head_cnt - 1; + size_t l2len;

vu_set_vnethdr(vdev, iov->iov_base, buf_cnt);

@@ -457,7 +459,8 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) tcp_vu_prepare(c, conn, iov, buf_cnt, &check, !*c->pcap, push);

/* Pad first/single buffer only, it's at least ETH_ZLEN long */ - vu_pad(iov, dlen + hdrlen); + l2len = dlen + hdrlen - VNET_HLEN; + vu_pad(iov, l2len);

if (*c->pcap) pcap_iov(iov, buf_cnt, VNET_HLEN);

-- Stefano