__virtio_net_hdr_to_skb() currently installs untrusted NEEDS_CSUM metadata into the skb with skb_partial_csum_set() and only then checks that the resulting transport offset is beyond the minimum network header length.
Validate the raw csum_start first. Successful packets are unchanged, but malformed metadata is rejected before it can transition the skb to CHECKSUM_PARTIAL state. This deliberately does not replace the broader ingress validation being discussed for virtio checksum metadata; it only narrows the state transition at the existing check. Link: https://lore.kernel.org/netdev/[email protected]/ Signed-off-by: tonegawa <[email protected]> --- include/linux/virtio_net.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h index d6466f96cdd00c..c8180f1222f492 100644 --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -102,9 +102,9 @@ static inline int __virtio_net_hdr_to_skb(struct sk_buff *skb, if (!pskb_may_pull(skb, needed)) return -EINVAL; - if (!skb_partial_csum_set(skb, start, off)) + if (start < nh_min_len) return -EINVAL; - if (skb_transport_offset(skb) < nh_min_len) + if (!skb_partial_csum_set(skb, start, off)) return -EINVAL; nh_min_len = skb_transport_offset(skb); -- 2.51.0
