Files
twx-linux/include/linux
Jonathan Davies fb2dbc124a net: virtio_net_hdr_to_skb: count transport header in UFO
[ Upstream commit cf9acc90c8 ]

virtio_net_hdr_to_skb does not set the skb's gso_size and gso_type
correctly for UFO packets received via virtio-net that are a little over
the GSO size. This can lead to problems elsewhere in the networking
stack, e.g. ovs_vport_send dropping over-sized packets if gso_size is
not set.

This is due to the comparison

  if (skb->len - p_off > gso_size)

not properly accounting for the transport layer header.

p_off includes the size of the transport layer header (thlen), so
skb->len - p_off is the size of the TCP/UDP payload.

gso_size is read from the virtio-net header. For UFO, fragmentation
happens at the IP level so does not need to include the UDP header.

Hence the calculation could be comparing a TCP/UDP payload length with
an IP payload length, causing legitimate virtio-net packets to have
lack gso_type/gso_size information.

Example: a UDP packet with payload size 1473 has IP payload size 1481.
If the guest used UFO, it is not fragmented and the virtio-net header's
flags indicate that it is a GSO frame (VIRTIO_NET_HDR_GSO_UDP), with
gso_size = 1480 for an MTU of 1500.  skb->len will be 1515 and p_off
will be 42, so skb->len - p_off = 1473.  Hence the comparison fails, and
shinfo->gso_size and gso_type are not set as they should be.

Instead, add the UDP header length before comparing to gso_size when
using UFO. In this way, it is the size of the IP payload that is
compared to gso_size.

Fixes: 6dd912f826 ("net: check untrusted gso_size at kernel entry")
Signed-off-by: Jonathan Davies <jonathan.davies@nutanix.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-26 10:47:19 +01:00
..
2020-02-19 19:53:09 +01:00
2021-01-30 13:54:11 +01:00
2020-03-25 08:25:58 +01:00
2021-05-19 10:08:30 +02:00
2021-03-04 10:26:29 +01:00
2021-02-07 15:35:49 +01:00
2021-11-17 09:48:17 +01:00
2021-06-30 08:47:51 -04:00
2020-07-29 10:18:36 +02:00
2021-09-03 10:08:12 +02:00
2020-03-18 07:17:46 +01:00
2020-04-02 15:11:00 +02:00
2021-03-07 12:20:49 +01:00
2020-12-11 13:23:28 +01:00
2021-08-26 08:36:16 -04:00
2020-04-02 15:11:00 +02:00
2021-06-10 13:37:14 +02:00