A TUN or virtio-net user can supply CHECKSUM_PARTIAL metadata whose checksum start resolves inside the IPv4 header after link-layer headers are removed. On the IPv4 fragmentation path, skb_checksum_help() may then modify an IHL which was already parsed and validated. ip_do_fragment() subsequently trusts the changed IHL and can copy beyond the skb's logical linear head into emitted IPv4 options.
Patch 1 validates the checksum start relative to skb_network_header(). Patch 2 independently validates and retains the IPv4 header length before checksum completion. The issue and this series were reviewed privately. The source reproducer and complete runtime evidence remain available privately. Validation included strict checkpatch, focused W=1 builds, a complete build, two test boots, a legitimate fragmented CHECKSUM_PARTIAL control, and both forged cases. Paulos Yibelo (2): net: validate virtio checksum start after network header ipv4: reject partial checksums covering the IP header include/linux/virtio_net.h | 5 +++-- net/ipv4/ip_output.c | 23 +++++++++++++++++------ 2 files changed, 20 insertions(+), 8 deletions(-) base-commit: 9d565b6b72fe3f41fd43636e143072848105189f
