virtio_net_hdr_tnl_to_skb() does not check that a UDP tunnel GSO packet really has outer IPv4/IPv6 and UDP headers matching the declared tunnel type. A guest, or any tap writer, can send a frame with another outer ethertype (NSH in the report), and the GSO stack then builds segments with skb->data before skb->head. The host crashes in skb_under_panic() as soon as a header is pushed.
Patch 1 validates the outer headers, using the parsing helpers from Michael's series "net: resolve uncommon partial checksums at ingress", as Willem suggested. The callers tell whether frames start with an Ethernet header, as the device type of a tun device can be changed with TUNSETLINK. The rest of Michael's series (checksum validation and completion) is left to him. Patch 2 clears a stale skb->protocol left on recycled NAPI frags skbs, which could make the checks of patch 1 reject valid frames. The selftests of v3 will follow in a separate series, with the fixes Sashiko found in them. v4: - Squash v3 patch 2 into patch 1 (Willem). Dropped Michael's Acked-by, as virtio_net_l3_start() now takes a has_eth argument. - Patch 2: clear skb->protocol in tun_napi_alloc_frags(), the only place that needs it (Willem). - Drop the selftests from this series (Willem). v3: https://lore.kernel.org/netdev/[email protected]/ - Patch 1: fix a comment, ipv6_find_hdr() stops at AH (Sashiko). - New patch 2: do not use the device type to find the outer L3 header, TUNSETLINK can change it (Sashiko). - New patch 3: clear a stale skb->protocol on IFF_NAPI_FRAGS skbs (Sashiko). - More selftests, and big-endian fixes for them (Sashiko). v2: https://lore.kernel.org/netdev/[email protected]/ - Use Michael's helpers instead of a new one: find the L3 header from the device type instead of assuming Ethernet when skb->protocol is unset, do not trust skb->protocol when it disagrees with the frame, and require UDP exactly at outer_th_offset. Stop at IPv6 AH headers (Willem). - Selftest fixes, IFF_TUN tests. v1: https://lore.kernel.org/netdev/[email protected]/ Eric Dumazet (2): net: virtio: validate outer protocol of UDP tunnel GSO packets tun: clear stale skb->protocol of NAPI frags skbs drivers/net/tun.c | 15 +++- drivers/net/tun_vnet.h | 5 +- drivers/net/virtio_net.c | 2 +- include/linux/virtio_net.h | 169 +++++++++++++++++++++++++++++++++++++ 4 files changed, 186 insertions(+), 5 deletions(-) base-commit: f66469d9905b39d2c260a15d7d6db450f4db67c1 -- 2.53.0
