As reported first by Paulos Yibelo <[email protected]> (after which
others, credited below, found more ways the bug can affect users):
allowing untrusted hardware to specify csum start/offset for
CHECKSUM_PARTIAL was not a good idea, because, if it edits the packet
outside the actual checksum, and depending on the setup, the networking
stack could be looking at the packet both before and after the edit, and
seeing different results.
Previously, commit 6785011f8b16 ("ipv4: validate checksum_start before
completing checksum") validated all known instances where this
causes the most grief, but the real fix is to make sure
that either only actual checksum fields are ever edited,
or the checksum is completed before the net stack looks at it,
so it is always consistent.
This basically goes back to
what we did before f43798c27684 ("tun: Allow GSO using virtio_net_hdr"),
except in a narrow list of specified known good cases.
Summary of the patchset:
These are definitely net material (and seem to be too big for stable,
or I would recommend backporting there, too):
net: account for ingress-resolved virtio net hdr state
- accounting, not the fix itself, dependency of the next one
net: resolve uncommon partial checksums at ingress
- fix itself
net: add a sysctl to opt out of virtio net hdr checksum validation
- reducing risk of the fix by adding a sysctl to disable it
These are cleanups, can be deferred to net-next, too:
net: add ip4_parse()
virtio_net: cleanup protocol calculation
- cleanup resulting code duplication
(kept separate to simplify backporting)
Fixes: f43798c27684 ("tun: Allow GSO using virtio_net_hdr")
Changes since v1:
- reorder patches to fix bisectability, addressing
a comment by Björn Töpel.
- code refactoring, different patch splitup,
a sysctl knob to disable as suggested by Willem de Bruijn.
- fix a bunch of minor issues spotted by LLMs
Changes since v2:
virtio_net: parse tunnel csum_start little-endian
- new patch. correctly parsing the header is a dependency
of validating it, otherwise i do not know what to validate
net: account for ingress-resolved virtio net hdr state
- make rx_csum_sw counter 64 bit so it won't wrap
(spotted by LLM review)
net: resolve uncommon partial checksums at ingress
- tunnel fixes to bugs noticed by Willem de Bruijn and
Chris Arges
- restore the csum_offset checks as suggested by Willem
- parse csum_start in the tunnel header little-endian like
the rest of it (spotted by LLM review)
net: add a sysctl to opt out of virtio net hdr checksum validation
- the knob is no longer writable by root inside a user
namespace: changing it now requires capable(CAP_NET_ADMIN)
suggested by Willem de Bruijn
net: add ip4_parse()
- comment converted to kernel-doc format (Willem de Bruijn)
um: vector: honor virtio net hdr conversion failures
- commit log tweaks
New patch:
um: vector: trim skbs before verifying the header
found by code review
Somewhat tested, tunnel also tested now, um part compiled only
Michael S. Tsirkin (8):
net: account for ingress-resolved virtio net hdr state
um: vector: honor virtio net hdr conversion failures
um: vector: trim skbs before verifying the header
virtio_net: parse tunnel csum_start little-endian
net: resolve uncommon partial checksums at ingress
net: add a sysctl to opt out of virtio net hdr checksum validation
net: add ip4_parse()
virtio_net: cleanup protocol calculation
Documentation/admin-guide/sysctl/net.rst | 19 ++
arch/um/drivers/vector_kern.c | 6 +-
arch/um/drivers/vector_transports.c | 4 +-
drivers/net/tap.c | 4 +-
drivers/net/tun.c | 41 +++-
drivers/net/virtio_net.c | 2 +-
include/linux/ip.h | 27 +++
include/linux/virtio_net.h | 272 ++++++++++++++++++++++-
include/net/netns/core.h | 1 +
net/bridge/br_netfilter_hooks.c | 15 +-
net/core/dev.c | 6 +
net/core/net_namespace.c | 1 +
net/core/sysctl_net_core.c | 60 +++++
net/ipv4/ip_input.c | 13 +-
net/ipv4/netfilter/nf_reject_ipv4.c | 13 +-
net/packet/af_packet.c | 4 +-
16 files changed, 445 insertions(+), 43 deletions(-)
--
MST
