RHEL 8 and 9 KVM: Large packets sent from guests via virtio-net with UFO are dropped.

Issue

RHEL 8 and 9 KVM: Large packets sent from guests via virtio-net with UFO(Udp Fragmentation Offload) are dropped.

Reproducer Environment Sample:

=== KVM host1

[root@host1 /]# uname -r
4.18.0-513.5.1.el8_9.x86_64
[root@host1 /]# ip link show master br0
3: enp0s31f6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UP mode DEFAULT group default qlen 1000
    link/ether c8:5b:76:9b:24:e7 brd ff:ff:ff:ff:ff:ff
12: vnet1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br0 state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether fe:54:00:60:00:d8 brd ff:ff:ff:ff:ff:ff
14: vnet3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br0 state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether fe:54:00:f2:f2:33 brd ff:ff:ff:ff:ff:ff
[root@host1 /]#

=== Guest vm2

[root@vm2 /]# ip addr list dev eth0
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:f2:f2:33 brd ff:ff:ff:ff:ff:ff
    inet 10.1.1.2/24 brd 10.1.1.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
[root@vm2 /]# 

=== Guest vm1

[root@vm1 /]# uname -r
3.10.0-1160.el7.x86_64
[root@vm1 /]# ip addr list dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 52:54:00:60:00:d8 brd ff:ff:ff:ff:ff:ff
    inet 10.1.1.1/24 brd 10.1.1.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever
[root@vm1 /]# ethtool -i eth0 | head -1
driver: virtio_net
[root@vm1 /]# ethtool -k eth0 | grep udp-fragmentation-offload:
udp-fragmentation-offload: on
[root@vm1 /]# ls -l /tmp/data.1476
-rw-r--r-- 1 root root 1476 Sep  8 16:12 /tmp/data.1476
[root@vm1 /]# date; cat /tmp/data.1477 | nc -u 10.1.1.2 10000
Mon Sep  8 16:16:51 JST 2025
[root@vm1 /]# date; ethtool -K eth0 ufo off
Mon Sep  8 16:18:20 JST 2025
[root@vm1 /]# date; cat /tmp/data.1477 | nc -u 10.1.1.2 10000
Mon Sep  8 16:18:23 JST 2025
[root@vm1 /]# 

Issue:

[root@host1 /]# tcpdump -i vnet1 -nne '! (icmp or arp)' 2>/tmp/stderr
16:16:51.472061 52:54:00:60:00:d8 > 52:54:00:f2:f2:33, ethertype IPv4 (0x0800), length 1519: 10.1.1.1.37042 > 10.1.1.2.10000: UDP, length 1477
16:18:23.227888 52:54:00:60:00:d8 > 52:54:00:f2:f2:33, ethertype IPv4 (0x0800), length 1514: 10.1.1.1.48782 > 10.1.1.2.10000: UDP, bad length 1477 > 1472
16:18:23.227904 52:54:00:60:00:d8 > 52:54:00:f2:f2:33, ethertype IPv4 (0x0800), length 39: 10.1.1.1 > 10.1.1.2: ip-proto-17

[root@host1 /]# tcpdump -i vnet3 -nne '! (icmp or arp)' 2> /tmp/stderr
16:18:23.227898 52:54:00:60:00:d8 > 52:54:00:f2:f2:33, ethertype IPv4 (0x0800), length 1514: 10.1.1.1.48782 > 10.1.1.2.10000: UDP, bad length 1477 > 1472
16:18:23.227906 52:54:00:60:00:d8 > 52:54:00:f2:f2:33, ethertype IPv4 (0x0800), length 39: 10.1.1.1 > 10.1.1.2: ip-proto-17

The length 1477-byte packet was dropped at 16:16:51 before it reached vnet3. The tcpdump output at 16:18:23 confirms that running 'ethtool -K eth0 ufo off' on vm1 serves as a workaround.