On 2018年01月19日 22:29, Willem de Bruijn wrote:
From: Willem de Bruijn<[email protected]> Validate gso_type during segmentation as SKB_GSO_DODGY sources may pass packets where the gso_type does not match the contents. Syzkaller was able to enter the SCTP gso handler with a packet of gso_type SKB_GSO_TCPV4. On entry of transport layer gso handlers, verify that the gso_type matches the transport protocol. Fixes: 90017accff61 ("sctp: Add GSO support") Link:http://lkml.kernel.org/r/<[email protected]> Reported-by:[email protected] Signed-off-by: Willem de Bruijn<[email protected]> --- Similar checks existed until removed in commit 5c7cdf339af5 ("gso: Remove arbitrary checks for unsupported GSO"). But those were limited to the TSO path, not software GSO. I believe that this issue goes back further, hence the Fixes at the first user of virtio_net_hdr. --- net/ipv4/esp4_offload.c | 3 +++ net/ipv4/tcp_offload.c | 3 +++ net/ipv4/udp_offload.c | 3 +++ net/ipv6/esp6_offload.c | 3 +++ net/ipv6/tcpv6_offload.c | 3 +++ net/ipv6/udp_offload.c | 3 +++ net/sctp/offload.c | 3 +++ 7 files changed, 21 insertions(+)
Acked-by: Jason Wang <[email protected]> Thanks
