virtio_net_hdr_tnl_to_skb() does not check that a UDP tunnel GSO
packet really has outer IPv4/IPv6 and UDP headers matching the
declared tunnel type. A guest, or any tap writer, can send a frame
with another outer ethertype (NSH in the report), and the GSO stack
then builds segments with skb->data before skb->head. The host
crashes in skb_under_panic() as soon as a header is pushed.
Patch 1 validates the outer headers, using the parsing helpers from
Michael's series "net: resolve uncommon partial checksums at ingress",
as Willem suggested. The rest of that series (checksum validation and
completion) is left to Michael.
Patch 2 lets the callers tell whether frames start with an Ethernet
header, instead of using the device type, which tun can change with
TUNSETLINK.
Patch 3 clears a stale skb->protocol left on recycled NAPI frags skbs,
which could make the checks of patch 1 reject valid frames.
Patch 4 fixes a selftest helper computing UDP checksums over a length
in network byte order.
Patches 5 to 7 add tun selftests, on tap and IFF_TUN devices: valid
outer IPv4/IPv6 frames are accepted; mismatched or non-UDP outer
headers and misplaced outer transport headers are rejected, also on
retyped devices.
Patch 8 makes the UDP tunnel selftests write the tunnel offsets of the
virtio header in little endian, so they work on big-endian hosts.
v3:
- Patch 1: fix a comment, ipv6_find_hdr() stops at AH (Sashiko).
- New patch 2, and its tests in patch 6: Sashiko found that changing
the device type with TUNSETLINK bypasses the checks of patch 1.
- New patch 3: Sashiko found that napi_reuse_skb() leaves a stale
skb->protocol on IFF_NAPI_FRAGS skbs.
- New patch 7: test cases Sashiko found missing in patch 5 (outer
IPv6, VLAN with IPv6 or with a wrong outer_th_offset, non-UDP outer
L4). Fixed the patch 5 changelog.
- New patch 8: big-endian hosts (Sashiko).
- Collected Reviewed-by and Acked-by tags.
v2: https://lore.kernel.org/netdev/20261104050131.629967-1-edumazet@kernel.org/ (local)
- Patch 1: use Michael's helpers instead of a new one: find the L3
header from the device type instead of assuming Ethernet when
skb->protocol is unset, do not trust skb->protocol when it disagrees
with the frame, and require UDP exactly at outer_th_offset. Stop at
IPv6 AH headers (Willem).
- Patch 2: clear udph->check before summing and send 0xffff instead
of a zero checksum (Willem).
- Patch 3: clear the reused buffer before building each frame (Willem).
Add IFF_TUN tests, where skb->protocol comes from the tun_pi header.
v1: https://lore.kernel.org/netdev/20261103203113.550604-1-edumazet@kernel.org/ (local)
Eric Dumazet (8):
net: virtio: validate outer protocol of UDP tunnel GSO packets
net: virtio: do not use dev->type to find the outer L3 header
tun: clear stale skb->protocol of NAPI frags skbs
selftests: net: tuntap: fix UDP checksum length in
build_udp_packet_csum()
selftests: net: tun: test outer protocol of UDP tunnel GSO packets
selftests: net: tun: test UDP tunnel GSO on retyped devices
selftests: net: tun: test more outer header mismatches of UDP tunnel
GSO
selftests: net: tuntap: write UDP tunnel offsets in little endian
drivers/net/tun.c | 14 +-
drivers/net/tun_vnet.h | 5 +-
drivers/net/virtio_net.c | 2 +-
include/linux/virtio_net.h | 169 +++++++
tools/testing/selftests/net/tun.c | 440 +++++++++++++++++++
tools/testing/selftests/net/tuntap_helpers.h | 29 +-
6 files changed, 649 insertions(+), 10 deletions(-)
base-commit: 37dfd0efbfffc20a57e41c2eb349ac49b1ca1ff8
--
2.53.0