Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] ipv4: signed-to-unsigned conversion bypasses checksum offset validation --
commit 35b578df884cddd68694d6e6f060c95a3382e235 Author: Paulos Yibelo <[email protected]> ipv4: reject partial checksums covering the IP header ip_do_fragment() completes a CHECKSUM_PARTIAL skb before reading the IPv4 header length. A virtualization interface can supply a checksum start that still points inside the IPv4 header after link-layer removal. > diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c > index a24cc8ee11d3e..ff902a2dd0ade 100644 > --- a/net/ipv4/ip_output.c > +++ b/net/ipv4/ip_output.c > @@ -770,16 +770,28 @@ int ip_do_fragment(struct net *net, struct sock *sk, > struct sk_buff *skb, [ ... ] > + /* Complete offloaded checksums only after the validated IP header. */ > + if (skb->ip_summed == CHECKSUM_PARTIAL) { > + if (unlikely(skb_checksum_start_offset(skb) < hlen)) { [Severity: Medium] Will this comparison correctly catch negative checksum offsets? If a TUN/TAP device supplies a packet with a csum_start that points before the linear data, skb_checksum_start_offset(skb) will return a negative int. Since hlen is an unsigned int, this negative offset will be promoted to a large unsigned value during the comparison, bypassing the validation check. This could allow an invalid packet to proceed to skb_checksum_help(), which safely aborts the operation but triggers a WARN_ONCE that can cause a panic if panic_on_warn is enabled. > + err = -EINVAL; > + goto fail; > + } > + err = skb_checksum_help(skb); > + if (err) > + goto fail; > + iph = ip_hdr(skb); > + } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
