virtio_net_hdr_tnl_to_skb() does not check that a UDP tunnel GSO packet really has outer IPv4/IPv6 and UDP headers matching the declared tunnel type. A guest, or any tap writer, can send a frame with another outer ethertype (NSH in the report), and the GSO stack then builds segments with skb->data before skb->head. The host crashes in skb_under_panic() as soon as a header is pushed.
Patch 1 validates the outer headers, using the parsing helpers from Michael's series "net: resolve uncommon partial checksums at ingress", as Willem suggested. The rest of that series (checksum validation and completion) is left to Michael. Patch 2 lets the callers tell whether frames start with an Ethernet header, instead of using the device type, which tun can change with TUNSETLINK. Patch 3 clears a stale skb->protocol left on recycled NAPI frags skbs, which could make the checks of patch 1 reject valid frames. Patch 4 fixes a selftest helper computing UDP checksums over a length in network byte order. Patches 5 to 7 add tun selftests, on tap and IFF_TUN devices: valid outer IPv4/IPv6 frames are accepted; mismatched or non-UDP outer headers and misplaced outer transport headers are rejected, also on retyped devices. Patch 8 makes the UDP tunnel selftests write the tunnel offsets of the virtio header in little endian, so they work on big-endian hosts. v3: - Patch 1: fix a comment, ipv6_find_hdr() stops at AH (Sashiko). - New patch 2, and its tests in patch 6: Sashiko found that changing the device type with TUNSETLINK bypasses the checks of patch 1. - New patch 3: Sashiko found that napi_reuse_skb() leaves a stale skb->protocol on IFF_NAPI_FRAGS skbs. - New patch 7: test cases Sashiko found missing in patch 5 (outer IPv6, VLAN with IPv6 or with a wrong outer_th_offset, non-UDP outer L4). Fixed the patch 5 changelog. - New patch 8: big-endian hosts (Sashiko). - Collected Reviewed-by and Acked-by tags. v2: https://lore.kernel.org/netdev/[email protected]/ - Patch 1: use Michael's helpers instead of a new one: find the L3 header from the device type instead of assuming Ethernet when skb->protocol is unset, do not trust skb->protocol when it disagrees with the frame, and require UDP exactly at outer_th_offset. Stop at IPv6 AH headers (Willem). - Patch 2: clear udph->check before summing and send 0xffff instead of a zero checksum (Willem). - Patch 3: clear the reused buffer before building each frame (Willem). Add IFF_TUN tests, where skb->protocol comes from the tun_pi header. v1: https://lore.kernel.org/netdev/[email protected]/ Eric Dumazet (8): net: virtio: validate outer protocol of UDP tunnel GSO packets net: virtio: do not use dev->type to find the outer L3 header tun: clear stale skb->protocol of NAPI frags skbs selftests: net: tuntap: fix UDP checksum length in build_udp_packet_csum() selftests: net: tun: test outer protocol of UDP tunnel GSO packets selftests: net: tun: test UDP tunnel GSO on retyped devices selftests: net: tun: test more outer header mismatches of UDP tunnel GSO selftests: net: tuntap: write UDP tunnel offsets in little endian drivers/net/tun.c | 14 +- drivers/net/tun_vnet.h | 5 +- drivers/net/virtio_net.c | 2 +- include/linux/virtio_net.h | 169 +++++++ tools/testing/selftests/net/tun.c | 440 +++++++++++++++++++ tools/testing/selftests/net/tuntap_helpers.h | 29 +- 6 files changed, 649 insertions(+), 10 deletions(-) base-commit: 37dfd0efbfffc20a57e41c2eb349ac49b1ca1ff8 -- 2.53.0
