From: Alexander Bluhm <bluhm@openbsd.org>
Subject: tcp softlro ethernet padding
To: tech@openbsd.org
Date: Mon, 28 Apr 2025 21:04:44 +0200

Hi,

Back then when I was debugging ix(4) LRO, I found that the RX mbuf
returned from the driver may contain ethernet padding.  My tests
did not see this behavior with ixl(4) hardware.  But inserting
ethernet padding into a TCP stream would be completely wrong, so I
suggest adding this sanity check.

ok?

bluhm

Index: netinet/tcp_input.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/tcp_input.c,v
diff -u -p -r1.440 tcp_input.c
--- netinet/tcp_input.c	23 Apr 2025 17:52:12 -0000	1.440
+++ netinet/tcp_input.c	28 Apr 2025 18:57:48 -0000
@@ -4453,6 +4453,18 @@ tcp_softlro_glue(struct mbuf_list *ml, s
 		goto out;
 
 	ether_extract_headers(mtail, &tail);
+
+	if (tail.tcp) {
+		int tcpdatalen;
+
+		/* Remove possible ethernet padding at the end. */
+		tcpdatalen = tail.iplen - tail.iphlen - tail.tcphlen;
+		if (tcpdatalen < tail.paylen ) {
+			m_adj(mtail, tcpdatalen - tail.paylen);
+			tail.paylen = tcpdatalen;
+		}
+	}
+
 	if (!tcp_softlro_check(mtail, &tail)) {
 		mtail->m_pkthdr.ph_mss = 0;
 		goto out;