A virtio-net header can supply CHECKSUM_PARTIAL metadata whose checksum start resolves inside a network header. Software checksum completion can then modify bytes the stack has already parsed.
Patch 1 checks the data-relative L3 origin in the virtio-net conversion paths. Patch 2 checks the parsed header length before checksum completion in IPv4 and IPv6 fragmentation paths. Changes in v6 address Michael S. Tsirkin's review of v5: - Name the Ethernet-only L3 parser accordingly. - Derive the AF_PACKET L3 offset and protocol from the actual Ethernet frame, including inline VLAN tags on an ETH_P_IP raw socket. - Use the IPv6 base-header minimum for IPv6 checksum-only packets, including IFF_TUN before skb->protocol is set. - Restore Assisted-by: LLM on both patches. Patch 2's code is unchanged. Validation: focused x86 allmodconfig and UML defconfig W=1 object builds, strict checkpatch, and application of the exact mail series to the stated base. No runtime regression reproducer was run. Link: https://lore.kernel.org/netdev/[email protected]/ Paulos Yibelo (2): net: validate virtio checksum start after network header ip: reject partial checksums covering network headers arch/um/drivers/vector_transports.c | 13 +++- drivers/net/tun_vnet.h | 52 ++++++++++++- drivers/net/virtio_net.c | 10 ++- include/linux/virtio_net.h | 87 ++++++++++++++++++---- net/bridge/netfilter/nf_conntrack_bridge.c | 21 ++++-- net/ipv4/ip_output.c | 23 ++++-- net/ipv6/ip6_output.c | 12 ++- net/ipv6/netfilter.c | 12 ++- net/packet/af_packet.c | 24 +++++- 9 files changed, 214 insertions(+), 40 deletions(-) base-commit: 1e24c4f2ee44be0eee94092b5d13cbdb4bdf0d60 -- 2.46.0
