virtio_net_hdr_tnl_to_skb() does not check that a UDP tunnel GSO
packet really has outer IPv4/IPv6 and UDP headers matching the
declared tunnel type. A guest, or any tap writer, can send a frame
with another outer ethertype (NSH in the report), and the GSO stack
then builds segments with skb->data before skb->head. The host
crashes in skb_under_panic() as soon as a header is pushed.
Patch 1 validates the outer headers, using the parsing helpers from
Michael's series "net: resolve uncommon partial checksums at ingress",
as Willem suggested. The callers tell whether frames start with an
Ethernet header, as the device type of a tun device can be changed
with TUNSETLINK. The rest of Michael's series (checksum validation and
completion) is left to him.
Patch 2 clears a stale skb->protocol left on recycled NAPI frags skbs,
which could make the checks of patch 1 reject valid frames.
The selftests of v3 will follow in a separate series, with the fixes
Sashiko found in them.
v4:
- Squash v3 patch 2 into patch 1 (Willem). Dropped Michael's Acked-by,
as virtio_net_l3_start() now takes a has_eth argument.
- Patch 2: clear skb->protocol in tun_napi_alloc_frags(), the only
place that needs it (Willem).
- Drop the selftests from this series (Willem).
v3: https://lore.kernel.org/netdev/20261105115715.1466924-1-edumazet@kernel.org/ (local)
- Patch 1: fix a comment, ipv6_find_hdr() stops at AH (Sashiko).
- New patch 2: do not use the device type to find the outer L3 header,
TUNSETLINK can change it (Sashiko).
- New patch 3: clear a stale skb->protocol on IFF_NAPI_FRAGS skbs
(Sashiko).
- More selftests, and big-endian fixes for them (Sashiko).
v2: https://lore.kernel.org/netdev/20261104050131.629967-1-edumazet@kernel.org/ (local)
- Use Michael's helpers instead of a new one: find the L3 header from
the device type instead of assuming Ethernet when skb->protocol is
unset, do not trust skb->protocol when it disagrees with the frame,
and require UDP exactly at outer_th_offset. Stop at IPv6 AH headers
(Willem).
- Selftest fixes, IFF_TUN tests.
v1: https://lore.kernel.org/netdev/20261103203113.550604-1-edumazet@kernel.org/ (local)
Eric Dumazet (2):
net: virtio: validate outer protocol of UDP tunnel GSO packets
tun: clear stale skb->protocol of NAPI frags skbs
drivers/net/tun.c | 15 +++-
drivers/net/tun_vnet.h | 5 +-
drivers/net/virtio_net.c | 2 +-
include/linux/virtio_net.h | 169 +++++++++++++++++++++++++++++++++++++
4 files changed, 186 insertions(+), 5 deletions(-)
base-commit: f66469d9905b39d2c260a15d7d6db450f4db67c1
--
2.53.0