Re: Kernel bug report: unguarded deferred skb_checksum_help() writes corrupt the previously-validated IPv6 fixed header (IPv6 counterpart of commit 6785011f8b16, "ipv4: validate checksum_start before completing checksum")

["Michael S. Tsirkin" <mst@redhat.com>]

On Mon, Oct 19, 2026 at 02:13:04PM +0530, Pranjal Kumar Singh wrote:
> Hello Security Team,
> 
> The IPv4 part of this was fixed some time ago in commit 6785011f8b16
> ("ipv4: validate checksum_start before completing checksum"): a packet
> whose virtio_net_hdr csum metadata points its checksum start inside the
> IP header makes skb_checksum_help() (the deferred csum completion)
> rewrite the header the stack has already validated (fixed checksum
> offset-width write at csum_start + csum_offset).  The IPv6 paths were
> not covered, and they still are not: a 2-patch series mirroring that
> commit for IPv4->IPv6, including its remaining not-yet-IPv6-guarded
> sinks, is reproduced below and attached as patches/0001 and 0002.

Thanks, I think this has been reported already. Just to clarify, the effect
is just packet header corruption past validation, right?

See [PATCH net-next v2 0/7] more virtio-net csum hardening
for WIP fixes.

-- 
MST