[PATCH net] inet: frags: strip GSO state from fragments before reassembly

[PATCH net] inet: frags: strip GSO state from fragments before reassembly

[Paolo Abeni]

From: Xinyang Ge <xinyang@anthropic.com>

A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark
an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.
inet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first
fragment's skb as the head of the reassembled datagram, including its
shinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments
on frag_list with whatever linear/paged layout they arrived with.

After ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the
reassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and
the next software segmentation point - udp_rcv_segment() on local
delivery, validate_xmit_skb(), or the ip_finish_output_gso() slow
path - hands it to skb_segment(). skb_segment()'s frag_list walk
assumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to
a tap by an unprivileged user in its own userns are enough:

  kernel BUG at net/core/skbuff.c:4899!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2
  RIP: 0010:skb_segment+0x20ca/0x48b0
  Call Trace:
   <TASK>
   __udp_gso_segment+0x29a/0x27d0
   udp4_ufo_fragment+0x458/0x6c0
   inet_gso_segment+0x429/0x1340
   skb_mac_gso_segment+0x233/0x4f0
   __skb_gso_segment+0x308/0x660
   udp_queue_rcv_skb+0x440/0xad0
   udp_unicast_rcv_skb+0xc7/0x2c0
   udp_rcv+0x16ce/0x2260
   ip_protocol_deliver_rcu+0x197/0x2d0
   ip_local_deliver+0x430/0x690
   ip_rcv+0x16f/0x1f0
   __netif_receive_skb_one_core+0x15e/0x1c0
   __netif_receive_skb+0x1e/0x110
   netif_receive_skb+0xf6/0x5c0
   tun_rx_batched.isra.0+0x3ab/0x790
   tun_get_user+0x17c3/0x3550
   tun_chr_write_iter+0xba/0x1b0
   vfs_write+0x646/0x1130
   </TASK>
  Kernel panic - not syncing: Fatal exception in interrupt

This runs with BH disabled, so it is a panic rather than an oops. The
same is reachable with CAP_NET_RAW in a netns where a defrag point
precedes a GSO point, and from a guest whose VMM forwards
virtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by
commit 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting
gso_size mangled skb having linear-headed frag_list") and by
commit 9e4b7a99a03a ("net: gso: fix panic on frag_list with mixed head
alloc types") do not cover it: page-backed heads skip them, and kmalloc
heads skip them when gso_size == skb_headlen(head), which the sender
controls.

An skb entering a frag queue is an IP fragment by definition and
cannot legitimately carry GSO state: GRO does not merge fragments and
the stack segments before it fragments, so only untrusted sources are
affected. This has been reachable since
commit f43798c27684 ("tun: Allow GSO using virtio_net_hdr"), the first
path that let userspace attach GSO metadata to an IP fragment. Reset
the GSO fields of every fragment as it is queued, in
inet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and
6lowpan reassembly share; then neither the head nor the frag_list
members of the reassembled skb carry them (the members matter too:
the ip_do_fragment()/ip6_fragment() fast paths send them out as they
are). The head may remain CHECKSUM_PARTIAL; that is already accepted
on receive and resolved by skb_checksum_help() in
ip_do_fragment()/ip6_fragment() on forward.

Tested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer
above, two further IPv4 frag_list geometries that reach
BUG_ON(i >= nfrags) and BUG_ON(!list_skb->head_frag), and an IPv6
fragment-header variant (udp6_ufo_fragment()) each panic the unpatched
kernel; with this patch all four datagrams are delivered intact and
nothing is logged.

Fixes: f43798c27684 ("tun: Allow GSO using virtio_net_hdr")
Cc: stable@kernel.org
Suggested-by: Eric Dumazet <edumazet@google.com>
Assisted-by: Claude:unspecified
Signed-off-by: Xinyang Ge <xinyang@anthropic.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
 net/ipv4/inet_fragment.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index fc0cb993959f..c17e57ec7d5c 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -435,6 +435,13 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
 {
 	struct sk_buff *last = q->fragments_tail;
 
+	/* An IP fragment is never a GSO packet, but an untrusted source
+	 * (virtio_net_hdr) may have attached GSO metadata to it. Do not let
+	 * that reach the reassembled skb, whose head keeps the first
+	 * fragment's shinfo and whose frag_list is not GRO-shaped.
+	 */
+	skb_gso_reset(skb);
+
 	/* RFC5722, Section 4, amended by Errata ID : 3089
 	 *                          When reassembling an IPv6 datagram, if
 	 *   one or more its constituent fragments is determined to be an
-- 
2.55.0

Re: [PATCH net] inet: frags: strip GSO state from fragments before reassembly

[Eric Dumazet]

On Thu, Aug 27, 2026 at 4:07 PM Paolo Abeni <pabeni@redhat.com> wrote:
>
> From: Xinyang Ge <xinyang@anthropic.com>
>
> A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark
> an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.
> inet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first
> fragment's skb as the head of the reassembled datagram, including its
> shinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments
> on frag_list with whatever linear/paged layout they arrived with.
>
> After ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the
> reassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and
> the next software segmentation point - udp_rcv_segment() on local
> delivery, validate_xmit_skb(), or the ip_finish_output_gso() slow
> path - hands it to skb_segment(). skb_segment()'s frag_list walk
> assumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to
> a tap by an unprivileged user in its own userns are enough:
>

Reviewed-by: Eric Dumazet <edumazet@google.com>

Re: [PATCH net] inet: frags: strip GSO state from fragments before reassembly

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 27 Aug 2026 16:07:07 +0200 you wrote:
> From: Xinyang Ge <xinyang@anthropic.com>
> 
> A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark
> an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.
> inet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first
> fragment's skb as the head of the reassembled datagram, including its
> shinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments
> on frag_list with whatever linear/paged layout they arrived with.
> 
> [...]

Here is the summary with links:
  - [net] inet: frags: strip GSO state from fragments before reassembly
    https://git.kernel.org/netdev/net/c/d5dc1e69fd72

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html