[PATCH net] net: virtio_net: decode tunnel csum_start as little-endian

[PATCH net] net: virtio_net: decode tunnel csum_start as little-endian

[Cheng Yongkang]

virtio_net_hdr_tnl_to_skb() decodes hdr->csum_start with the caller's
little_endian argument when it validates the inner header offsets, but
then calls __virtio_net_hdr_to_skb() with little_endian hard-coded to
true.  The other tunnel offsets are always decoded as little-endian as
well.

tun passes tun_vnet_is_little_endian(), which is false when the device
uses big-endian legacy headers: by default on big-endian hosts, and
after TUNSETVNETBE on little-endian hosts with CONFIG_TUN_VNET_CROSS_LE.
The validation and the parser then disagree on csum_start.  For
example, the bytes 14 00 decode as 5120 for the validation and as 20
for the parser, so an inner_nh_offset beyond the data pulled into the
linear area passes the check, and the USO branch reads iphdr->version
out of bounds:

  BUG: KASAN: slab-out-of-bounds in tun_vnet_hdr_tnl_to_skb+0x74b/0x830
  Read of size 1 at addr ffff88807999d044 by task kvd-program/9399
  Call Trace:
   tun_vnet_hdr_tnl_to_skb+0x74b/0x830
   tun_get_user+0x1827/0x3d00
   tun_chr_write_iter+0x113/0x200
   vfs_write+0x5c9/0xb30

Decode csum_start as little-endian, matching the parser.  Callers that
pass little_endian == true are unaffected.

Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
---
 include/linux/virtio_net.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index d6466f96cdd0..ddc6341747e5 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -324,7 +324,7 @@ virtio_net_hdr_tnl_to_skb(struct sk_buff *skb,
 	inner_l3min = virtio_l3min(inner_isv6);
 	outer_l3min = ETH_HLEN + virtio_l3min(outer_isv6);
 
-	inner_th = __virtio16_to_cpu(little_endian, hdr->csum_start);
+	inner_th = le16_to_cpu(hdr->csum_start);
 	inner_nh = le16_to_cpu(vhdr->inner_nh_offset);
 	outer_th = le16_to_cpu(vhdr->outer_th_offset);
 	if (outer_th < outer_l3min ||

base-commit: f4377bf85887f57b59abb5479f7660a81ffe4449
-- 
2.34.1

Re: [PATCH net] net: virtio_net: decode tunnel csum_start as little-endian

[Michael S. Tsirkin]

On Thu, Oct 22, 2026 at 08:26:48AM -0700, Cheng Yongkang wrote:
> virtio_net_hdr_tnl_to_skb() decodes hdr->csum_start with the caller's
> little_endian argument when it validates the inner header offsets, but
> then calls __virtio_net_hdr_to_skb() with little_endian hard-coded to
> true.  The other tunnel offsets are always decoded as little-endian as
> well.
> 
> tun passes tun_vnet_is_little_endian(), which is false when the device
> uses big-endian legacy headers: by default on big-endian hosts, and
> after TUNSETVNETBE on little-endian hosts with CONFIG_TUN_VNET_CROSS_LE.
> The validation and the parser then disagree on csum_start.  For
> example, the bytes 14 00 decode as 5120 for the validation and as 20
> for the parser, so an inner_nh_offset beyond the data pulled into the
> linear area passes the check, and the USO branch reads iphdr->version
> out of bounds:
> 
>   BUG: KASAN: slab-out-of-bounds in tun_vnet_hdr_tnl_to_skb+0x74b/0x830
>   Read of size 1 at addr ffff88807999d044 by task kvd-program/9399
>   Call Trace:
>    tun_vnet_hdr_tnl_to_skb+0x74b/0x830
>    tun_get_user+0x1827/0x3d00
>    tun_chr_write_iter+0x113/0x200
>    vfs_write+0x5c9/0xb30
> 
> Decode csum_start as little-endian, matching the parser.  Callers that
> pass little_endian == true are unaffected.
> 
> Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
> Assisted-by: LLM
> Signed-off-by: Cheng Yongkang <teel4res@gmail.com>


duplicate of
dfcede18b8d54519bf586b8e5099e89ec63bf014.1792668082.git.mst@redhat.com ?

> ---
>  include/linux/virtio_net.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
> index d6466f96cdd0..ddc6341747e5 100644
> --- a/include/linux/virtio_net.h
> +++ b/include/linux/virtio_net.h
> @@ -324,7 +324,7 @@ virtio_net_hdr_tnl_to_skb(struct sk_buff *skb,
>  	inner_l3min = virtio_l3min(inner_isv6);
>  	outer_l3min = ETH_HLEN + virtio_l3min(outer_isv6);
>  
> -	inner_th = __virtio16_to_cpu(little_endian, hdr->csum_start);
> +	inner_th = le16_to_cpu(hdr->csum_start);
>  	inner_nh = le16_to_cpu(vhdr->inner_nh_offset);
>  	outer_th = le16_to_cpu(vhdr->outer_th_offset);
>  	if (outer_th < outer_l3min ||
> 
> base-commit: f4377bf85887f57b59abb5479f7660a81ffe4449
> -- 
> 2.34.1

Re: [PATCH net] net: virtio_net: decode tunnel csum_start as little-endian

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] net: virtio_net: sparse __virtio16 mismatch in virtio_net_hdr_tnl_to_skb()
--

commit ba7ce0ae4b2dfb77c6b110ada68faaf66de9237f
Author: Cheng Yongkang <teel4res@gmail.com>

net: virtio_net: decode tunnel csum_start as little-endian

This commit changes virtio_net_hdr_tnl_to_skb() in include/linux/virtio_net.h
to always decode hdr->csum_start as little-endian during tunnel header offset
validation, matching the subsequent call to __virtio_net_hdr_to_skb().

> diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
> index d6466f96cdd00..ddc6341747e53 100644
> --- a/include/linux/virtio_net.h
> +++ b/include/linux/virtio_net.h
> @@ -324,7 +324,7 @@ virtio_net_hdr_tnl_to_skb(struct sk_buff *skb,
>  	inner_l3min = virtio_l3min(inner_isv6);
>  	outer_l3min = ETH_HLEN + virtio_l3min(outer_isv6);
>  
> -	inner_th = __virtio16_to_cpu(little_endian, hdr->csum_start);
> +	inner_th = le16_to_cpu(hdr->csum_start);
>  	inner_nh = le16_to_cpu(vhdr->inner_nh_offset);
>  	outer_th = le16_to_cpu(vhdr->outer_th_offset);
>  	if (outer_th < outer_l3min ||

[Severity: Low]
Does passing hdr->csum_start directly to le16_to_cpu() in
virtio_net_hdr_tnl_to_skb() trigger sparse endianness warnings when building
callers such as drivers/net/virtio_net.c and drivers/net/tun.c with C=1?

Unlike vhdr->inner_nh_offset and vhdr->outer_th_offset, which are declared as
__le16 in struct virtio_net_hdr_v1_hash_tunnel, hdr->csum_start is declared as
__virtio16 in include/uapi/linux/virtio_net.h:

struct virtio_net_hdr {
	...
	__virtio16 csum_start;	/* Position to start checksumming from */
	__virtio16 csum_offset;	/* Offset after that to place checksum */
};

In include/linux/virtio_byteorder.h, __virtio16_to_cpu() performs the forced
cast from __virtio16 to __le16 before calling le16_to_cpu():

static inline u16 __virtio16_to_cpu(bool little_endian, __virtio16 val)
{
	if (little_endian)
		return le16_to_cpu((__force __le16)val);
	else
		return be16_to_cpu((__force __be16)val);
}

Should this use __virtio16_to_cpu(true, hdr->csum_start) instead, matching the
__virtio_net_hdr_to_skb(skb, hdr, true, ...) call below and
__cpu_to_virtio16(true, hdr_len) in __virtio_net_set_tnl_hdrlen()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179268538303.70821.1734486381476363942@gmail.com?part=1

Re: [PATCH net] net: virtio_net: decode tunnel csum_start as little-endian

[Michael S. Tsirkin]

On Fri, Oct 23, 2026 at 04:09:57PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Low] net: virtio_net: sparse __virtio16 mismatch in virtio_net_hdr_tnl_to_skb()
> --
> 
> commit ba7ce0ae4b2dfb77c6b110ada68faaf66de9237f
> Author: Cheng Yongkang <teel4res@gmail.com>
> 
> net: virtio_net: decode tunnel csum_start as little-endian
> 
> This commit changes virtio_net_hdr_tnl_to_skb() in include/linux/virtio_net.h
> to always decode hdr->csum_start as little-endian during tunnel header offset
> validation, matching the subsequent call to __virtio_net_hdr_to_skb().
> 
> > diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
> > index d6466f96cdd00..ddc6341747e53 100644
> > --- a/include/linux/virtio_net.h
> > +++ b/include/linux/virtio_net.h
> > @@ -324,7 +324,7 @@ virtio_net_hdr_tnl_to_skb(struct sk_buff *skb,
> >  	inner_l3min = virtio_l3min(inner_isv6);
> >  	outer_l3min = ETH_HLEN + virtio_l3min(outer_isv6);
> >  
> > -	inner_th = __virtio16_to_cpu(little_endian, hdr->csum_start);
> > +	inner_th = le16_to_cpu(hdr->csum_start);
> >  	inner_nh = le16_to_cpu(vhdr->inner_nh_offset);
> >  	outer_th = le16_to_cpu(vhdr->outer_th_offset);
> >  	if (outer_th < outer_l3min ||
> 
> [Severity: Low]
> Does passing hdr->csum_start directly to le16_to_cpu() in
> virtio_net_hdr_tnl_to_skb() trigger sparse endianness warnings when building
> callers such as drivers/net/virtio_net.c and drivers/net/tun.c with C=1?
> 
> Unlike vhdr->inner_nh_offset and vhdr->outer_th_offset, which are declared as
> __le16 in struct virtio_net_hdr_v1_hash_tunnel, hdr->csum_start is declared as
> __virtio16 in include/uapi/linux/virtio_net.h:
> 
> struct virtio_net_hdr {
> 	...
> 	__virtio16 csum_start;	/* Position to start checksumming from */
> 	__virtio16 csum_offset;	/* Offset after that to place checksum */
> };
> 
> In include/linux/virtio_byteorder.h, __virtio16_to_cpu() performs the forced
> cast from __virtio16 to __le16 before calling le16_to_cpu():
> 
> static inline u16 __virtio16_to_cpu(bool little_endian, __virtio16 val)
> {
> 	if (little_endian)
> 		return le16_to_cpu((__force __le16)val);
> 	else
> 		return be16_to_cpu((__force __be16)val);
> }
> 
> Should this use __virtio16_to_cpu(true, hdr->csum_start) instead, matching the
> __virtio_net_hdr_to_skb(skb, hdr, true, ...) call below and
> __cpu_to_virtio16(true, hdr_len) in __virtio_net_set_tnl_hdrlen()?


Ugh. In fact it does. Should be __virtio16_to_cpu(true, hdr->csum_start)
and I had exactly that in v5. Not sure at what point I picked
an old version of that (

It's just a warning - functionally the same - so if v6 goes in, I'll fix
it by a patch on top.

> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/179268538303.70821.1734486381476363942@gmail.com?part=1

Re: [PATCH net] net: virtio_net: decode tunnel csum_start as little-endian

[Michael S. Tsirkin]

On Fri, Oct 23, 2026 at 04:09:57PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Low] net: virtio_net: sparse __virtio16 mismatch in virtio_net_hdr_tnl_to_skb()
> --
> 
> commit ba7ce0ae4b2dfb77c6b110ada68faaf66de9237f
> Author: Cheng Yongkang <teel4res@gmail.com>
> 
> net: virtio_net: decode tunnel csum_start as little-endian
> 
> This commit changes virtio_net_hdr_tnl_to_skb() in include/linux/virtio_net.h
> to always decode hdr->csum_start as little-endian during tunnel header offset
> validation, matching the subsequent call to __virtio_net_hdr_to_skb().
> 
> > diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
> > index d6466f96cdd00..ddc6341747e53 100644
> > --- a/include/linux/virtio_net.h
> > +++ b/include/linux/virtio_net.h
> > @@ -324,7 +324,7 @@ virtio_net_hdr_tnl_to_skb(struct sk_buff *skb,
> >  	inner_l3min = virtio_l3min(inner_isv6);
> >  	outer_l3min = ETH_HLEN + virtio_l3min(outer_isv6);
> >  
> > -	inner_th = __virtio16_to_cpu(little_endian, hdr->csum_start);
> > +	inner_th = le16_to_cpu(hdr->csum_start);
> >  	inner_nh = le16_to_cpu(vhdr->inner_nh_offset);
> >  	outer_th = le16_to_cpu(vhdr->outer_th_offset);
> >  	if (outer_th < outer_l3min ||
> 
> [Severity: Low]
> Does passing hdr->csum_start directly to le16_to_cpu() in
> virtio_net_hdr_tnl_to_skb() trigger sparse endianness warnings when building
> callers such as drivers/net/virtio_net.c and drivers/net/tun.c with C=1?
> 
> Unlike vhdr->inner_nh_offset and vhdr->outer_th_offset, which are declared as
> __le16 in struct virtio_net_hdr_v1_hash_tunnel, hdr->csum_start is declared as
> __virtio16 in include/uapi/linux/virtio_net.h:
> 
> struct virtio_net_hdr {
> 	...
> 	__virtio16 csum_start;	/* Position to start checksumming from */
> 	__virtio16 csum_offset;	/* Offset after that to place checksum */
> };
> 
> In include/linux/virtio_byteorder.h, __virtio16_to_cpu() performs the forced
> cast from __virtio16 to __le16 before calling le16_to_cpu():
> 
> static inline u16 __virtio16_to_cpu(bool little_endian, __virtio16 val)
> {
> 	if (little_endian)
> 		return le16_to_cpu((__force __le16)val);
> 	else
> 		return be16_to_cpu((__force __be16)val);
> }
> 
> Should this use __virtio16_to_cpu(true, hdr->csum_start) instead, matching the
> __virtio_net_hdr_to_skb(skb, hdr, true, ...) call below and
> __cpu_to_virtio16(true, hdr_len) in __virtio_net_set_tnl_hdrlen()?


Ah no wait, this is not my v6. My v6 is ok.


> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/179268538303.70821.1734486381476363942@gmail.com?part=1