Merge branch 'net-always-dissect-gso-packets-in-__virtio_net_hdr_to_skb'

Browse source

Eric Dumazet says:

====================
net: always dissect GSO packets in __virtio_net_hdr_to_skb()

This series fixes a bypass of untrusted GSO flow dissection in
__virtio_net_hdr_to_skb() when VIRTIO_NET_HDR_F_NEEDS_CSUM is not set,
and adds a kselftest covering VLAN-tagged GSO packets without NEEDS_CSUM:

- Patch 1 fixes __skb_flow_dissect(), which computes key_control->thoff
  with min_t(u16, ...). This truncates skb->len and returns a bogus small
  transport offset when skb->len modulo 65536 is smaller than the
  transport offset. Offsets that do not fit in the u16 thoff now fail the
  dissection instead of being silently truncated.

- Patch 2 initializes skb->dev and skb->network_header before calling
  virtio_net_hdr_*_to_skb() in tun_get_user(), tun_xdp_one(),
  virtnet_receive_done(), and raw_verify_header(), removes the
  '&& skb->network_header' condition and the unvalidated
  'else if (gso_type)' fallback in __virtio_net_hdr_to_skb(), and moves
  virtio_net_hdr_match_proto() after skb_flow_dissect_flow_keys_basic()
  so it validates the dissected L3 protocol (keys.basic.n_proto) rather
  than the outer L2 protocol.

- Patch 3 adds kselftests in tools/testing/selftests/net/tun.c verifying
  that VLAN-tagged (802.1Q) TCPv4 GSO packets without NEEDS_CSUM (both
  flags = 0 and flags = VIRTIO_NET_HDR_F_DATA_VALID) are accepted on a
  TAP device, that mismatched GSO types and truncated TCP headers without
  NEEDS_CSUM are rejected with -EINVAL, and that a 65540-byte frame is
  accepted.
====================

Link: https://patch.msgid.link/20261001191140.2818991-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Jakub Kicinski 2026-10-06 15:35:42 -07:00

parent d5a007b9b4 ee2d4c2d7c

commit ab699d296e

6 changed files with 186 additions and 45 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

arch/um/drivers/vector_transports.c

View file

23

drivers/net/tun.c

View file

2

drivers/net/virtio_net.c

View file

64

include/linux/virtio_net.h

View file

9

net/core/flow_dissector.c

View file

136

tools/testing/selftests/net/tun.c

View file