Re: [PATCH net v4 2/2] ipv4: reject partial checksums covering the IP header

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] ipv4: signed-to-unsigned conversion bypasses checksum offset validation
--

commit 35b578df884cddd68694d6e6f060c95a3382e235
Author: Paulos Yibelo <habte.yibelo@gmail.com>

ipv4: reject partial checksums covering the IP header

ip_do_fragment() completes a CHECKSUM_PARTIAL skb before reading the IPv4
header length. A virtualization interface can supply a checksum start that
still points inside the IPv4 header after link-layer removal.

> diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
> index a24cc8ee11d3e..ff902a2dd0ade 100644
> --- a/net/ipv4/ip_output.c
> +++ b/net/ipv4/ip_output.c
> @@ -770,16 +770,28 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,

[ ... ]

> +	/* Complete offloaded checksums only after the validated IP header. */
> +	if (skb->ip_summed == CHECKSUM_PARTIAL) {
> +		if (unlikely(skb_checksum_start_offset(skb) < hlen)) {

[Severity: Medium]
Will this comparison correctly catch negative checksum offsets?

If a TUN/TAP device supplies a packet with a csum_start that points before
the linear data, skb_checksum_start_offset(skb) will return a negative int.

Since hlen is an unsigned int, this negative offset will be promoted to a
large unsigned value during the comparison, bypassing the validation check.

This could allow an invalid packet to proceed to skb_checksum_help(), which
safely aborts the operation but triggers a WARN_ONCE that can cause a panic
if panic_on_warn is enabled.

> +			err = -EINVAL;
> +			goto fail;
> +		}
> +		err = skb_checksum_help(skb);
> +		if (err)
> +			goto fail;
> +		iph = ip_hdr(skb);
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260920004733.6473-1-habte.yibelo@gmail.com?part=2