Michael S. Tsirkin wrote:
> As reported first by Paulos Yibelo <[email protected]> (after which
> others, credited below, found more ways the bug can affect users) a
> virtio net header can place CHECKSUM_PARTIAL at any in-packet offset.
> If that state is retained, later checksum completion can modify the
> packet after protocol processing has made decisions from it.
>
> Let's fix that: let's validate csum_start and csum_offset and only keep
> CHECKSUM_PARTIAL when csum_start and csum_offset match a parsed TCP or
> UDP header, while handling VLAN headers, IPv4 options and IPv6 extension
> headers. Complete other non-GSO checksums immediately, before any
> protocol processing runs.
>
> We can't easily "complete the checksum" for GSO we don't recognize - GSO
> assumes knowledge of the protocol. We could segment ignoring the
> checksum then do whatever csum_start and csum_offset say, but that
> seems like an overkill for something that shouldn't happen.
>
> There's some risk here:
> - non-gso packets which can't be parsed get checksum calculated in
> software, adding performance overhead
> - gso packets which can't be parsed get dropped
The biggest risk I see of valid packets reaching this path is packet
sockets that are not bound to a specific protocol (ETH_P_ALL) over a
non Ethernet device.
Iff proto is 0 we could try to infer from the first nibble at the
network header:
+ iph = (const void *)(skb->data + nhoff);
+ if (!proto) {
+ if (iph->version == 4)
+ proto = htons(ETH_P_IP);
+ else if (iph->version == 6)
+ proto = htons(ETH_P_IPV6);
+ }
