<glm>
The tunnel header format is only produced by standard-compliant
devices, so all of its fields, csum_start included, are
little-endian. The nested virtio net header import already
parsed csum_start that way, but the inner transport offset was
parsed with the endianness specified by the interface.
On an interface in legacy big-endian mode the two parses of the
same field disagreed, and the value stored in
skb->inner_transport_header - which is only bounds-checked from
below - could point past the end of the packet, where GSO
segmentation later dereferences it.
</glm>
Parse the field little-endian in both places.
Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO
tunneling.")
Cc: Paolo Abeni <[email protected]>
Assisted-by: LLM
Signed-off-by: Michael S. Tsirkin <[email protected]>
---
include/linux/virtio_net.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index d6466f96cdd0..013c6c7e2dea 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -324,7 +324,7 @@ virtio_net_hdr_tnl_to_skb(struct sk_buff *skb,
inner_l3min = virtio_l3min(inner_isv6);
outer_l3min = ETH_HLEN + virtio_l3min(outer_isv6);
- inner_th = __virtio16_to_cpu(little_endian, hdr->csum_start);
+ inner_th = __virtio16_to_cpu(true, hdr->csum_start);
inner_nh = le16_to_cpu(vhdr->inner_nh_offset);
outer_th = le16_to_cpu(vhdr->outer_th_offset);
if (outer_th < outer_l3min ||
--
MST
