diff options
| author | Willem de Bruijn <willemb@google.com> | 2019-02-18 23:37:12 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-02-21 14:08:13 -0800 |
| commit | 9e8db5913264d3967b93c765a6a9e464d9c473db (patch) | |
| tree | 4b85aa0a1cace6820ddfd86504c4e6550378c8a0 /include/linux/virtio_net.h | |
| parent | 06cd1702eeb0a79de03f3088ccf4c65f6dfeeaf5 (diff) | |
| download | lwn-9e8db5913264d3967b93c765a6a9e464d9c473db.tar.gz lwn-9e8db5913264d3967b93c765a6a9e464d9c473db.zip | |
net: avoid false positives in untrusted gso validation
GSO packets with vnet_hdr must conform to a small set of gso_types.
The below commit uses flow dissection to drop packets that do not.
But it has false positives when the skb is not fully initialized.
Dissection needs skb->protocol and skb->network_header.
Infer skb->protocol from gso_type as the two must agree.
SKB_GSO_UDP can use both ipv4 and ipv6, so try both.
Exclude callers for which network header offset is not known.
Fixes: d5be7f632bad ("net: validate untrusted gso packets without csum offload")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/linux/virtio_net.h')
| -rw-r--r-- | include/linux/virtio_net.h | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h index 71f2394abbf7..e0348cb0a1dd 100644 --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -61,10 +61,20 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, /* gso packets without NEEDS_CSUM do not set transport_offset. * probe and drop if does not match one of the above types. */ - if (gso_type) { + if (gso_type && skb->network_header) { + if (!skb->protocol) + virtio_net_hdr_set_proto(skb, hdr); +retry: skb_probe_transport_header(skb, -1); - if (!skb_transport_header_was_set(skb)) + if (!skb_transport_header_was_set(skb)) { + /* UFO does not specify ipv4 or 6: try both */ + if (gso_type & SKB_GSO_UDP && + skb->protocol == htons(ETH_P_IP)) { + skb->protocol = htons(ETH_P_IPV6); + goto retry; + } return -EINVAL; + } } } |