[PATCH net v3] net: gso: validate transport header before computing segment length
From: Michael S. Tsirkin <mst@redhat.com>
Date: 2026-10-21 15:13:45
If a TSO packet is processed in the stack before a transport
header was ever established, the TCP data offset is read through the
unset header offset, far outside the packet.
This was demonstrated by syzkaller, back when the input path did not
dissect such packets: a virtio net header supplying a malformed
network header was enough. Qdisc length estimation has carried a
guard against exactly this since
commit a0dce8752193 ("net: Skip GSO length estimation if transport header is not set");
the GSO length validators never got one.
We used to, but we no longer allow such packets in: since
commit 44378d02c5aa ("net: always dissect GSO packets in __virtio_net_hdr_to_skb()")
the virtio net input path dissects all GSO packets.
But as a defence in depth measure, let's also check before we read: if
the TCP header is unset or outside the linear data, report the packet
as not fitting. What happens to it then is up to the caller: the IP
output path segments in software, a forwarder answers with an ICMP
error, policers apply their exceed action.
No unprivileged path is known to produce one - IP input resets the
transport header to the parsed position, local delivery pulls data
exactly to it, and tunnel decapsulation clears it altogether - but a tc
BPF program can leave one behind through bpf_skb_adjust_room(). The
comparison is free, so let's not rely on enumerating producers.
Found by code review.
Fixes: f43798c27684 ("tun: Allow GSO using virtio_net_hdr")
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
include/linux/skbuff.h | 30 +++++++++++++++++
net/core/gso.c | 75 ++++++++++++++++++++++++++++++++++++------
2 files changed, 95 insertions(+), 10 deletions(-)diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index a3ff380d43f0..6f33c014e568 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h@@ -3041,6 +3041,13 @@ static inline bool skb_inner_network_header_was_set(const struct sk_buff *skb) return skb->inner_network_header > 0; } +static inline bool skb_inner_transport_header_was_set(const struct sk_buff *skb) +{ + typeof(skb->inner_transport_header) th = skb->inner_transport_header; + + return th > 0 && th != (typeof(th))~0U; +} + static inline unsigned char *skb_inner_mac_header(const struct sk_buff *skb) { return skb->head + skb->inner_mac_header;
@@ -3250,6 +3257,29 @@ static inline int skb_transport_offset(const struct sk_buff *skb) return skb_transport_header(skb) - skb->data; } +/* Is the (inner) transport header, as specified by + * skb->transport_header/inner_transport_header, in the linear data? + */ +static inline bool skb_transport_header_linear(const struct sk_buff *skb, + unsigned int hlen) +{ + int thoff; + + if (!skb_transport_header_was_set(skb)) + return false; + + if (skb->encapsulation) { + if (!skb_inner_transport_header_was_set(skb)) + return false; + + thoff = skb_inner_transport_offset(skb); + } else { + thoff = skb_transport_offset(skb); + } + + return thoff >= 0 && thoff + hlen <= skb_headlen(skb); +} + static inline u32 skb_network_header_len(const struct sk_buff *skb) { DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb));
diff --git a/net/core/gso.c b/net/core/gso.c
index e96ef6350064..204ab9d08c18 100644
--- a/net/core/gso.c
+++ b/net/core/gso.c@@ -131,6 +131,22 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb, } EXPORT_SYMBOL(__skb_gso_segment); +/* + * TSO processing (but not UDP/SCTP GSO, which uses fixed header + * sizes) reads the TCP header as specified by + * skb->transport_header/inner_transport_header. Make sure it is + * there to read. + */ +static bool skb_tso_transport_header_ok(const struct sk_buff *skb) +{ + const struct skb_shared_info *shinfo = skb_shinfo(skb); + + if (unlikely(!(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))) + return true; + + return skb_transport_header_linear(skb, sizeof(struct tcphdr)); +} + /** * skb_gso_transport_seglen - Return length of individual segments of a gso packet *
@@ -140,12 +156,18 @@ EXPORT_SYMBOL(__skb_gso_segment); * individual segments, including Layer4 headers (TCP/UDP). * * The MAC/L2 or network (IP, IPv6) headers are not accounted for. + * + * Return: the length, or a negative errno if the TCP header is not + * there to read. */ -static unsigned int skb_gso_transport_seglen(const struct sk_buff *skb) +static int skb_gso_transport_seglen(const struct sk_buff *skb) { const struct skb_shared_info *shinfo = skb_shinfo(skb); unsigned int thlen = 0; + if (unlikely(!skb_tso_transport_header_ok(skb))) + return -EINVAL; + if (skb->encapsulation) { thlen = skb_inner_transport_header(skb) - skb_transport_header(skb);
@@ -175,13 +197,21 @@ static unsigned int skb_gso_transport_seglen(const struct sk_buff *skb) * individual segments, including Layer3 (IP, IPv6) and L4 headers (TCP/UDP). * * The MAC/L2 header is not accounted for. + * + * Return: the length, or a negative errno if the TCP header is not + * there to read. */ -static unsigned int skb_gso_network_seglen(const struct sk_buff *skb) +static int skb_gso_network_seglen(const struct sk_buff *skb) { - unsigned int hdr_len = skb_transport_header(skb) - - skb_network_header(skb); + int tlen = skb_gso_transport_seglen(skb); + unsigned int hdr_len; - return hdr_len + skb_gso_transport_seglen(skb); + if (tlen < 0) + return tlen; + + hdr_len = skb_transport_header(skb) - skb_network_header(skb); + + return hdr_len + tlen; } /**
@@ -192,12 +222,21 @@ static unsigned int skb_gso_network_seglen(const struct sk_buff *skb) * skb_gso_mac_seglen is used to determine the real size of the * individual segments, including MAC/L2, Layer3 (IP, IPv6) and L4 * headers (TCP/UDP). + * + * Return: the length, or a negative errno if the TCP header is not + * there to read. */ -static unsigned int skb_gso_mac_seglen(const struct sk_buff *skb) +static int skb_gso_mac_seglen(const struct sk_buff *skb) { - unsigned int hdr_len = skb_transport_header(skb) - skb_mac_header(skb); + int tlen = skb_gso_transport_seglen(skb); + unsigned int hdr_len; - return hdr_len + skb_gso_transport_seglen(skb); + if (tlen < 0) + return tlen; + + hdr_len = skb_transport_header(skb) - skb_mac_header(skb); + + return hdr_len + tlen; } /**
@@ -250,10 +289,18 @@ static inline bool skb_gso_size_check(const struct sk_buff *skb, * skb_gso_validate_network_len validates if a given skb will fit a * wanted MTU once split. It considers L3 headers, L4 headers, and the * payload. + * + * Return: Whether the skb will fit. Also false if the TCP header + * is not there to read. */ bool skb_gso_validate_network_len(const struct sk_buff *skb, unsigned int mtu) { - return skb_gso_size_check(skb, skb_gso_network_seglen(skb), mtu); + int seg_len = skb_gso_network_seglen(skb); + + if (seg_len < 0) + return false; + + return skb_gso_size_check(skb, seg_len, mtu); } EXPORT_SYMBOL_GPL(skb_gso_validate_network_len);
@@ -265,10 +312,18 @@ EXPORT_SYMBOL_GPL(skb_gso_validate_network_len); * * skb_gso_validate_mac_len validates if a given skb will fit a wanted * length once split, including L2, L3 and L4 headers and the payload. + * + * Return: Whether the skb will fit. Also false if the TCP header + * is not there to read. */ bool skb_gso_validate_mac_len(const struct sk_buff *skb, unsigned int len) { - return skb_gso_size_check(skb, skb_gso_mac_seglen(skb), len); + int seg_len = skb_gso_mac_seglen(skb); + + if (seg_len < 0) + return false; + + return skb_gso_size_check(skb, seg_len, len); } EXPORT_SYMBOL_GPL(skb_gso_validate_mac_len);
--
MST