> virtio_net_hdr_tnl_to_skb() trusts the virtio header to describe a > UDP tunnel over IPv4 or IPv6, but never checks that the frame actually > carries such outer headers. Because VIRTIO_NET_HDR_F_NEEDS_CSUM is > mandatory for tunnel GSO, __virtio_net_hdr_to_skb() skips the flow > dissector, so virtio_net_hdr_match_proto() is never applied either. > > A guest (or a tap writer) can then inject a frame with an arbitrary > outer ethertype, for example ETH_P_NSH, with SKB_GSO_UDP_TUNNEL set. > The GSO stack then runs nsh_gso_segment() on top of the UDP tunnel > segmentation, which assumes a different header layout. The result is > segments with skb->data before skb->head, and a host crash in > skb_under_panic() as soon as a later layer pushes a header: > > skbuff: skb_under_panic: ... put:4 ... dev:gretap1 > kernel BUG at net/core/skbuff.c:215! > [ ... ] > Co-developed-by: Michael S. Tsirkin <[email protected]> > Signed-off-by: Michael S. Tsirkin <[email protected]> > Reviewed-by: Willem de Bruijn <[email protected]> > Acked-by: Michael S. Tsirkin <[email protected]> > Signed-off-by: Eric Dumazet <[email protected]>
Sashiko has reviewed this patch and found no issues. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
