From: Willem de Bruijn <willemdebruijn.ker...@gmail.com>
Date: Mon, 4 May 2020 12:48:54 -0400
> From: Willem de Bruijn <will...@google.com>
>
> Syzkaller again found a path to a kernel crash through bad gso input:
> a packet with transport header extending beyond skb_headlen(skb).
>
> Tighten validation at kernel entry:
>
> - Verify that the transport header lies within the linear section.
>
> To avoid pulling linux/tcp.h, verify just sizeof tcphdr.
> tcp_gso_segment will call pskb_may_pull (th->doff * 4) before use.
>
> - Match the gso_type against the ip_proto found by the flow dissector.
>
> Fixes: bfd5f4a3d605 ("packet: Add GSO/csum offload support.")
> Reported-by: syzbot <syzkal...@googlegroups.com>
> Signed-off-by: Willem de Bruijn <will...@google.com>
Applied and queued up for -stable, thanks.
