When a guest transmits a short Ethernet frame, iov_size() returns the
padded wire length including any bytes added to reach the Ethernet
minimum frame size of 60 bytes.  net_tx_pkt_rebuild_payload() uses
this inflated size as payload_len.  net_tx_pkt_update_ip_hdr_checksum()
then overwrites the IPv4 Total Length field with payload_len +
l3_hdr_len, inflating it by the padding.  The receiver interprets
Ethernet padding as IP payload, producing a malformed packet.

Fix by removing the ip_len write from net_tx_pkt_update_ip_hdr_checksum()
so it only recomputes the checksum, and moving the ip_len assignment
into net_tx_pkt_update_ip_checksums() where it is only performed for
TSO (where ip_len must be derived from payload_len since the guest sets
ip_len=0 per Intel 82574 datasheet §7.3.4 for super-packets the host
will segment).

Both e1000e and igb already call net_tx_pkt_update_ip_hdr_checksum()
from their IXSM paths, so both are corrected by this single common-
layer change.

Signed-off-by: Sanjeeva Yerrapureddy <y.sanjeevreddy@gmail.com>
---
Thank you Akihiko for the review of v4. I agree that avoiding two
similar functions is cleaner. v5 moves the ip_len write into
net_tx_pkt_update_ip_checksums() (the TSO path that already owns it)
and strips it from net_tx_pkt_update_ip_hdr_checksum(), which becomes a
pure checksum recomputation. The net effect is that both e1000e and igb
IXSM paths are corrected automatically without any device-layer change.

Changes in v5:
- Remove the ip_len write from net_tx_pkt_update_ip_hdr_checksum() so
  it only recomputes the checksum.
- Move the ip_len assignment into net_tx_pkt_update_ip_checksums() (the
  TSO path), which already called net_tx_pkt_update_ip_hdr_checksum()
  immediately after. The comment and the ip_len line are restored to
  their upstream positions.
- Remove net_tx_pkt_update_ip_hdr_checksum_only() entirely — no longer
  needed.
- Revert the e1000e IXSM path to its original call of
  net_tx_pkt_update_ip_hdr_checksum(). Because that function no longer
  inflates ip_len, igb (which already calls the same function) is also
  corrected with no additional change.
- Link to v4: https://lore.kernel.org/qemu-devel/20260628-net-tx-pkt-ip-length-padding-v4-1-829b36db5adb@gmail.com

Changes in v4:
- Add net_tx_pkt_update_ip_hdr_checksum_only(); call it from the e1000e
  IXSM path to avoid inflating ip_len.
- Link to v3: https://lore.kernel.org/qemu-devel/20260627-net-tx-pkt-ip-length-padding-v3-1-e860dabadd3f@gmail.com

Changes in v3:
- Architectural redesign: three-case fallback logic in
  net_tx_pkt_rebuild_payload() plus net_tx_pkt_set_payload_len() API;
  e1000e pre-sets payload_len from PAYLEN descriptor field.
- Link to v2: https://lore.kernel.org/qemu-devel/20260625-net-tx-pkt-ip-length-padding-v2-1-287d0ba59ec1@gmail.com

Changes in v2:
- Fix iov_copy() to use raw_payload_len and net_tx_pkt_get_total_len()
  to use iov_size() to preserve correct wire frame size.
- Link to v1: https://lore.kernel.org/qemu-devel/20260624-net-tx-pkt-ip-length-padding-v1-1-7a22fe9b4e40@gmail.com

On the relationship to the short-packet receive-path discussion
(Peter Maydell):
https://lore.kernel.org/qemu-devel/CAFEAcA_UhmCxJc16CHE=4ZR1+PA0=4-29=fEe+d+iUmhLTzpuQ@mail.gmail.com/

The linked thread concerns the receive path. This patch addresses only
the transmit path: the IXSM offload path was overwriting a correctly
set guest ip_len with an inflated value that included Ethernet padding.
No changes to padding behaviour or the receive path are made.

To: qemu-devel@nongnu.org
Cc: Dmitry Fleytman <dmitry.fleytman@gmail.com>
Cc: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Cc: Jason Wang <jasowang@redhat.com>
---
 hw/net/net_tx_pkt.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c
index 903238dca2..b134348fe8 100644
--- a/hw/net/net_tx_pkt.c
+++ b/hw/net/net_tx_pkt.c
@@ -93,9 +93,6 @@ void net_tx_pkt_update_ip_hdr_checksum(struct NetTxPkt *pkt)
     uint16_t csum;
     assert(pkt);
 
-    pkt->l3_hdr.ip.ip_len = cpu_to_be16(pkt->payload_len +
-        pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len);
-
     pkt->l3_hdr.ip.ip_sum = 0;
     csum = net_raw_checksum(pkt->l3_hdr.octets,
         pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len);
@@ -117,7 +114,9 @@ void net_tx_pkt_update_ip_checksums(struct NetTxPkt *pkt)
 
     if (gso_type == VIRTIO_NET_HDR_GSO_TCPV4 ||
         gso_type == VIRTIO_NET_HDR_GSO_UDP) {
-        /* Calculate IP header checksum */
+        /* Set ip_len and calculate IP header checksum */
+        pkt->l3_hdr.ip.ip_len = cpu_to_be16(pkt->payload_len +
+            pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len);
         net_tx_pkt_update_ip_hdr_checksum(pkt);
 
         /* Calculate IP pseudo header checksum */

---
base-commit: b83371668192a705b878e909c5ae9c1233cbd5fb
change-id: 20260628-net-tx-pkt-ip-length-padding-951e75fa97b4

Best regards,
--  
Sanjeeva Yerrapureddy <y.sanjeevreddy@gmail.com>

On 29.06.2026 18:21, Sanjeeva Yerrapureddy wrote:
> When a guest transmits a short Ethernet frame, iov_size() returns the
> padded wire length including any bytes added to reach the Ethernet
> minimum frame size of 60 bytes.  net_tx_pkt_rebuild_payload() uses
> this inflated size as payload_len.  net_tx_pkt_update_ip_hdr_checksum()
> then overwrites the IPv4 Total Length field with payload_len +
> l3_hdr_len, inflating it by the padding.  The receiver interprets
> Ethernet padding as IP payload, producing a malformed packet.
> 
> Fix by removing the ip_len write from net_tx_pkt_update_ip_hdr_checksum()
> so it only recomputes the checksum, and moving the ip_len assignment
> into net_tx_pkt_update_ip_checksums() where it is only performed for
> TSO (where ip_len must be derived from payload_len since the guest sets
> ip_len=0 per Intel 82574 datasheet §7.3.4 for super-packets the host
> will segment).
> 
> Both e1000e and igb already call net_tx_pkt_update_ip_hdr_checksum()
> from their IXSM paths, so both are corrected by this single common-
> layer change.

Hi!

This feels like a qemu-stable material.
I'm picking this one up for 10.0.x and 11.0.x series,
please let me know if I should not.

Thanks,

/mjt

On 29/6/26 17:21, Sanjeeva Yerrapureddy wrote:
> When a guest transmits a short Ethernet frame, iov_size() returns the
> padded wire length including any bytes added to reach the Ethernet
> minimum frame size of 60 bytes.  net_tx_pkt_rebuild_payload() uses
> this inflated size as payload_len.  net_tx_pkt_update_ip_hdr_checksum()
> then overwrites the IPv4 Total Length field with payload_len +
> l3_hdr_len, inflating it by the padding.  The receiver interprets
> Ethernet padding as IP payload, producing a malformed packet.
> 
> Fix by removing the ip_len write from net_tx_pkt_update_ip_hdr_checksum()
> so it only recomputes the checksum, and moving the ip_len assignment
> into net_tx_pkt_update_ip_checksums() where it is only performed for
> TSO (where ip_len must be derived from payload_len since the guest sets
> ip_len=0 per Intel 82574 datasheet §7.3.4 for super-packets the host
> will segment).
> 
> Both e1000e and igb already call net_tx_pkt_update_ip_hdr_checksum()
> from their IXSM paths, so both are corrected by this single common-
> layer change.
> 
> Signed-off-by: Sanjeeva Yerrapureddy <y.sanjeevreddy@gmail.com>
> ---
> Thank you Akihiko for the review of v4. I agree that avoiding two
> similar functions is cleaner. v5 moves the ip_len write into
> net_tx_pkt_update_ip_checksums() (the TSO path that already owns it)
> and strips it from net_tx_pkt_update_ip_hdr_checksum(), which becomes a
> pure checksum recomputation. The net effect is that both e1000e and igb
> IXSM paths are corrected automatically without any device-layer change.
> 
> Changes in v5:
> - Remove the ip_len write from net_tx_pkt_update_ip_hdr_checksum() so
>    it only recomputes the checksum.
> - Move the ip_len assignment into net_tx_pkt_update_ip_checksums() (the
>    TSO path), which already called net_tx_pkt_update_ip_hdr_checksum()
>    immediately after. The comment and the ip_len line are restored to
>    their upstream positions.
> - Remove net_tx_pkt_update_ip_hdr_checksum_only() entirely — no longer
>    needed.
> - Revert the e1000e IXSM path to its original call of
>    net_tx_pkt_update_ip_hdr_checksum(). Because that function no longer
>    inflates ip_len, igb (which already calls the same function) is also
>    corrected with no additional change.
> - Link to v4: https://lore.kernel.org/qemu-devel/20260628-net-tx-pkt-ip-length-padding-v4-1-829b36db5adb@gmail.com
> 
> Changes in v4:
> - Add net_tx_pkt_update_ip_hdr_checksum_only(); call it from the e1000e
>    IXSM path to avoid inflating ip_len.
> - Link to v3: https://lore.kernel.org/qemu-devel/20260627-net-tx-pkt-ip-length-padding-v3-1-e860dabadd3f@gmail.com
> 
> Changes in v3:
> - Architectural redesign: three-case fallback logic in
>    net_tx_pkt_rebuild_payload() plus net_tx_pkt_set_payload_len() API;
>    e1000e pre-sets payload_len from PAYLEN descriptor field.
> - Link to v2: https://lore.kernel.org/qemu-devel/20260625-net-tx-pkt-ip-length-padding-v2-1-287d0ba59ec1@gmail.com
> 
> Changes in v2:
> - Fix iov_copy() to use raw_payload_len and net_tx_pkt_get_total_len()
>    to use iov_size() to preserve correct wire frame size.
> - Link to v1: https://lore.kernel.org/qemu-devel/20260624-net-tx-pkt-ip-length-padding-v1-1-7a22fe9b4e40@gmail.com
> 
> On the relationship to the short-packet receive-path discussion
> (Peter Maydell):
> https://lore.kernel.org/qemu-devel/CAFEAcA_UhmCxJc16CHE=4ZR1+PA0=4-29=fEe+d+iUmhLTzpuQ@mail.gmail.com/
> 
> The linked thread concerns the receive path. This patch addresses only
> the transmit path: the IXSM offload path was overwriting a correctly
> set guest ip_len with an inflated value that included Ethernet padding.
> No changes to padding behaviour or the receive path are made.
> 
> To: qemu-devel@nongnu.org
> Cc: Dmitry Fleytman <dmitry.fleytman@gmail.com>
> Cc: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
> Cc: Jason Wang <jasowang@redhat.com>
> ---
>   hw/net/net_tx_pkt.c | 7 +++----
>   1 file changed, 3 insertions(+), 4 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

On 2026/06/30 0:21, Sanjeeva Yerrapureddy wrote:
> When a guest transmits a short Ethernet frame, iov_size() returns the
> padded wire length including any bytes added to reach the Ethernet
> minimum frame size of 60 bytes.  net_tx_pkt_rebuild_payload() uses
> this inflated size as payload_len.  net_tx_pkt_update_ip_hdr_checksum()
> then overwrites the IPv4 Total Length field with payload_len +
> l3_hdr_len, inflating it by the padding.  The receiver interprets
> Ethernet padding as IP payload, producing a malformed packet.
> 
> Fix by removing the ip_len write from net_tx_pkt_update_ip_hdr_checksum()
> so it only recomputes the checksum, and moving the ip_len assignment
> into net_tx_pkt_update_ip_checksums() where it is only performed for
> TSO (where ip_len must be derived from payload_len since the guest sets
> ip_len=0 per Intel 82574 datasheet §7.3.4 for super-packets the host
> will segment).
> 
> Both e1000e and igb already call net_tx_pkt_update_ip_hdr_checksum()
> from their IXSM paths, so both are corrected by this single common-
> layer change.
> 
> Signed-off-by: Sanjeeva Yerrapureddy <y.sanjeevreddy@gmail.com>

Reivewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>

Thank you for promptly responding to reviews and identifying the cause 
of the issue.

Regards,
Akihiko Odaki

> ---
> Thank you Akihiko for the review of v4. I agree that avoiding two
> similar functions is cleaner. v5 moves the ip_len write into
> net_tx_pkt_update_ip_checksums() (the TSO path that already owns it)
> and strips it from net_tx_pkt_update_ip_hdr_checksum(), which becomes a
> pure checksum recomputation. The net effect is that both e1000e and igb
> IXSM paths are corrected automatically without any device-layer change.
> 
> Changes in v5:
> - Remove the ip_len write from net_tx_pkt_update_ip_hdr_checksum() so
>    it only recomputes the checksum.
> - Move the ip_len assignment into net_tx_pkt_update_ip_checksums() (the
>    TSO path), which already called net_tx_pkt_update_ip_hdr_checksum()
>    immediately after. The comment and the ip_len line are restored to
>    their upstream positions.
> - Remove net_tx_pkt_update_ip_hdr_checksum_only() entirely — no longer
>    needed.
> - Revert the e1000e IXSM path to its original call of
>    net_tx_pkt_update_ip_hdr_checksum(). Because that function no longer
>    inflates ip_len, igb (which already calls the same function) is also
>    corrected with no additional change.
> - Link to v4: https://lore.kernel.org/qemu-devel/20260628-net-tx-pkt-ip-length-padding-v4-1-829b36db5adb@gmail.com
> 
> Changes in v4:
> - Add net_tx_pkt_update_ip_hdr_checksum_only(); call it from the e1000e
>    IXSM path to avoid inflating ip_len.
> - Link to v3: https://lore.kernel.org/qemu-devel/20260627-net-tx-pkt-ip-length-padding-v3-1-e860dabadd3f@gmail.com
> 
> Changes in v3:
> - Architectural redesign: three-case fallback logic in
>    net_tx_pkt_rebuild_payload() plus net_tx_pkt_set_payload_len() API;
>    e1000e pre-sets payload_len from PAYLEN descriptor field.
> - Link to v2: https://lore.kernel.org/qemu-devel/20260625-net-tx-pkt-ip-length-padding-v2-1-287d0ba59ec1@gmail.com
> 
> Changes in v2:
> - Fix iov_copy() to use raw_payload_len and net_tx_pkt_get_total_len()
>    to use iov_size() to preserve correct wire frame size.
> - Link to v1: https://lore.kernel.org/qemu-devel/20260624-net-tx-pkt-ip-length-padding-v1-1-7a22fe9b4e40@gmail.com
> 
> On the relationship to the short-packet receive-path discussion
> (Peter Maydell):
> https://lore.kernel.org/qemu-devel/CAFEAcA_UhmCxJc16CHE=4ZR1+PA0=4-29=fEe+d+iUmhLTzpuQ@mail.gmail.com/
> 
> The linked thread concerns the receive path. This patch addresses only
> the transmit path: the IXSM offload path was overwriting a correctly
> set guest ip_len with an inflated value that included Ethernet padding.
> No changes to padding behaviour or the receive path are made.
> 
> To: qemu-devel@nongnu.org
> Cc: Dmitry Fleytman <dmitry.fleytman@gmail.com>
> Cc: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
> Cc: Jason Wang <jasowang@redhat.com>
> ---
>   hw/net/net_tx_pkt.c | 7 +++----
>   1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c
> index 903238dca2..b134348fe8 100644
> --- a/hw/net/net_tx_pkt.c
> +++ b/hw/net/net_tx_pkt.c
> @@ -93,9 +93,6 @@ void net_tx_pkt_update_ip_hdr_checksum(struct NetTxPkt *pkt)
>       uint16_t csum;
>       assert(pkt);
>   
> -    pkt->l3_hdr.ip.ip_len = cpu_to_be16(pkt->payload_len +
> -        pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len);
> -
>       pkt->l3_hdr.ip.ip_sum = 0;
>       csum = net_raw_checksum(pkt->l3_hdr.octets,
>           pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len);
> @@ -117,7 +114,9 @@ void net_tx_pkt_update_ip_checksums(struct NetTxPkt *pkt)
>   
>       if (gso_type == VIRTIO_NET_HDR_GSO_TCPV4 ||
>           gso_type == VIRTIO_NET_HDR_GSO_UDP) {
> -        /* Calculate IP header checksum */
> +        /* Set ip_len and calculate IP header checksum */
> +        pkt->l3_hdr.ip.ip_len = cpu_to_be16(pkt->payload_len +
> +            pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len);
>           net_tx_pkt_update_ip_hdr_checksum(pkt);
>   
>           /* Calculate IP pseudo header checksum */
> 
> ---
> base-commit: b83371668192a705b878e909c5ae9c1233cbd5fb
> change-id: 20260628-net-tx-pkt-ip-length-padding-951e75fa97b4
> 
> Best regards,
> --
> Sanjeeva Yerrapureddy <y.sanjeevreddy@gmail.com>
> 

Thank you Akihiko!

On Tue, Jun 30, 2026 at 1:41 AM Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
wrote:

> On 2026/06/30 0:21, Sanjeeva Yerrapureddy wrote:
> > When a guest transmits a short Ethernet frame, iov_size() returns the
> > padded wire length including any bytes added to reach the Ethernet
> > minimum frame size of 60 bytes.  net_tx_pkt_rebuild_payload() uses
> > this inflated size as payload_len.  net_tx_pkt_update_ip_hdr_checksum()
> > then overwrites the IPv4 Total Length field with payload_len +
> > l3_hdr_len, inflating it by the padding.  The receiver interprets
> > Ethernet padding as IP payload, producing a malformed packet.
> >
> > Fix by removing the ip_len write from net_tx_pkt_update_ip_hdr_checksum()
> > so it only recomputes the checksum, and moving the ip_len assignment
> > into net_tx_pkt_update_ip_checksums() where it is only performed for
> > TSO (where ip_len must be derived from payload_len since the guest sets
> > ip_len=0 per Intel 82574 datasheet §7.3.4 for super-packets the host
> > will segment).
> >
> > Both e1000e and igb already call net_tx_pkt_update_ip_hdr_checksum()
> > from their IXSM paths, so both are corrected by this single common-
> > layer change.
> >
> > Signed-off-by: Sanjeeva Yerrapureddy <y.sanjeevreddy@gmail.com>
>
> Reivewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
>
> Thank you for promptly responding to reviews and identifying the cause
> of the issue.
>
> Regards,
> Akihiko Odaki
>
> > ---
> > Thank you Akihiko for the review of v4. I agree that avoiding two
> > similar functions is cleaner. v5 moves the ip_len write into
> > net_tx_pkt_update_ip_checksums() (the TSO path that already owns it)
> > and strips it from net_tx_pkt_update_ip_hdr_checksum(), which becomes a
> > pure checksum recomputation. The net effect is that both e1000e and igb
> > IXSM paths are corrected automatically without any device-layer change.
> >
> > Changes in v5:
> > - Remove the ip_len write from net_tx_pkt_update_ip_hdr_checksum() so
> >    it only recomputes the checksum.
> > - Move the ip_len assignment into net_tx_pkt_update_ip_checksums() (the
> >    TSO path), which already called net_tx_pkt_update_ip_hdr_checksum()
> >    immediately after. The comment and the ip_len line are restored to
> >    their upstream positions.
> > - Remove net_tx_pkt_update_ip_hdr_checksum_only() entirely — no longer
> >    needed.
> > - Revert the e1000e IXSM path to its original call of
> >    net_tx_pkt_update_ip_hdr_checksum(). Because that function no longer
> >    inflates ip_len, igb (which already calls the same function) is also
> >    corrected with no additional change.
> > - Link to v4:
> https://lore.kernel.org/qemu-devel/20260628-net-tx-pkt-ip-length-padding-v4-1-829b36db5adb@gmail.com
> >
> > Changes in v4:
> > - Add net_tx_pkt_update_ip_hdr_checksum_only(); call it from the e1000e
> >    IXSM path to avoid inflating ip_len.
> > - Link to v3:
> https://lore.kernel.org/qemu-devel/20260627-net-tx-pkt-ip-length-padding-v3-1-e860dabadd3f@gmail.com
> >
> > Changes in v3:
> > - Architectural redesign: three-case fallback logic in
> >    net_tx_pkt_rebuild_payload() plus net_tx_pkt_set_payload_len() API;
> >    e1000e pre-sets payload_len from PAYLEN descriptor field.
> > - Link to v2:
> https://lore.kernel.org/qemu-devel/20260625-net-tx-pkt-ip-length-padding-v2-1-287d0ba59ec1@gmail.com
> >
> > Changes in v2:
> > - Fix iov_copy() to use raw_payload_len and net_tx_pkt_get_total_len()
> >    to use iov_size() to preserve correct wire frame size.
> > - Link to v1:
> https://lore.kernel.org/qemu-devel/20260624-net-tx-pkt-ip-length-padding-v1-1-7a22fe9b4e40@gmail.com
> >
> > On the relationship to the short-packet receive-path discussion
> > (Peter Maydell):
> >
> https://lore.kernel.org/qemu-devel/CAFEAcA_UhmCxJc16CHE=4ZR1+PA0=4-29=fEe+d+iUmhLTzpuQ@mail.gmail.com/
> >
> > The linked thread concerns the receive path. This patch addresses only
> > the transmit path: the IXSM offload path was overwriting a correctly
> > set guest ip_len with an inflated value that included Ethernet padding.
> > No changes to padding behaviour or the receive path are made.
> >
> > To: qemu-devel@nongnu.org
> > Cc: Dmitry Fleytman <dmitry.fleytman@gmail.com>
> > Cc: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
> > Cc: Jason Wang <jasowang@redhat.com>
> > ---
> >   hw/net/net_tx_pkt.c | 7 +++----
> >   1 file changed, 3 insertions(+), 4 deletions(-)
> >
> > diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c
> > index 903238dca2..b134348fe8 100644
> > --- a/hw/net/net_tx_pkt.c
> > +++ b/hw/net/net_tx_pkt.c
> > @@ -93,9 +93,6 @@ void net_tx_pkt_update_ip_hdr_checksum(struct NetTxPkt
> *pkt)
> >       uint16_t csum;
> >       assert(pkt);
> >
> > -    pkt->l3_hdr.ip.ip_len = cpu_to_be16(pkt->payload_len +
> > -        pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len);
> > -
> >       pkt->l3_hdr.ip.ip_sum = 0;
> >       csum = net_raw_checksum(pkt->l3_hdr.octets,
> >           pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len);
> > @@ -117,7 +114,9 @@ void net_tx_pkt_update_ip_checksums(struct NetTxPkt
> *pkt)
> >
> >       if (gso_type == VIRTIO_NET_HDR_GSO_TCPV4 ||
> >           gso_type == VIRTIO_NET_HDR_GSO_UDP) {
> > -        /* Calculate IP header checksum */
> > +        /* Set ip_len and calculate IP header checksum */
> > +        pkt->l3_hdr.ip.ip_len = cpu_to_be16(pkt->payload_len +
> > +            pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len);
> >           net_tx_pkt_update_ip_hdr_checksum(pkt);
> >
> >           /* Calculate IP pseudo header checksum */
> >
> > ---
> > base-commit: b83371668192a705b878e909c5ae9c1233cbd5fb
> > change-id: 20260628-net-tx-pkt-ip-length-padding-951e75fa97b4
> >
> > Best regards,
> > --
> > Sanjeeva Yerrapureddy <y.sanjeevreddy@gmail.com>
> >
>
>

-- 
regards,
Sanjeeva Reddy.Y.