On 12/13/20 2:49 AM, Willem de Bruijn wrote:

On Sat, Dec 12, 2020 at 5:01 AM Vasily Averin [off-list ref] wrote:

quoted

On 12/11/20 6:37 PM, Vasily Averin wrote:

quoted

It seems for me the similar problem can happen in __skb_trim_rcsum().
Also I doubt that that skb_checksum_start_offset(skb) checks in
__skb_postpull_rcsum() and skb_csum_unnecessary() are correct,
becasue they do not guarantee that skb have correct CHECKSUM_PARTIAL.
Could somebody confirm it?

I've rechecked the code and I think now that other places are not affected,
i.e. skb_push_rcsum() only should be patched.

Thanks for investigating this. So tun was able to insert a packet with
csum_start + csum_off + 2 beyond the packet after trimming, using
virtio_net_hdr.csum_...

Any packet with an offset beyond the end of the packet is bogus
really. No need to try to accept it by downgrading to CHECKSUM_NONE.

Do you mean it's better to force pskb_trim_rcsum() to return -EINVAL instead?

Thank you,
	Vasily Averin