From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.9 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15392C43381 for ; Tue, 19 Feb 2019 04:37:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C9C2821848 for ; Tue, 19 Feb 2019 04:37:21 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ip0WzClK" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726168AbfBSEhU (ORCPT ); Mon, 18 Feb 2019 23:37:20 -0500 Received: from mail-qt1-f193.google.com ([209.85.160.193]:37018 "EHLO mail-qt1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725844AbfBSEhU (ORCPT ); Mon, 18 Feb 2019 23:37:20 -0500 Received: by mail-qt1-f193.google.com with SMTP id a48so21739880qtb.4 for ; Mon, 18 Feb 2019 20:37:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=CYSS2ixQ6EGD7dFYHoLitOFXzLP9pvlW/QDcMW0pKUk=; b=ip0WzClKq4pMJh1gb6BdLkRlDsK5dQQl1Lbpt1hnyNWdL/n8JrgQnLZXv/OfbbFW6v DJSTaC4BWOwKB67Ce4JGDHaNxATfCXKEdCVUJhL20FkkeGdH5xYDFnPdefwP5Pq80x4p z8ftfMaZ3h2fhuaZWIi5urNyBAu4H0Q/6Bn6XpinoxOkmaETGk0CUW8uHH9grImBCNGG tx6Y+hU8fBBhCXdXa1HJPTQr2xzXa9gswfwb5JajaGQOPRdECSGwu+yv9QCqWwG+f5ig RLH9D9ONpqnxrymg2U4Tc46d16KePOPQCTqVW16SiwBD7IJL/efcEhkABTehUEOuP8rX D42A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=CYSS2ixQ6EGD7dFYHoLitOFXzLP9pvlW/QDcMW0pKUk=; b=ef6CHfvqwpYs9GvFz6vOdRlR/Ek+osKlsigUA8pAkeWIDZ/qBWvWhX0pEnBD9DofQH hbwYAbdKnm19o7io3aDm1tKlnwKGBE2626fIhl1gMdbILz15ZLwsb3kmsZhdfL4mu5SD Fx6fBpKUi4z1jO125J4kWgQT91Dmw2xN5a5P2ARh9GsojMPSCOnDyNz0VpGobAS5iEM6 PpQ/8Fy6JYcegys05eciw6HrckRdZLsFehQZ0dDYJjNZAk9LE5/Wq48+vLqSYBvln0w0 a8RzmGkt1vX0eEyd3Ydd9OmirD6OMI62O7Xn7YCljZN9kHDekMUhQLRH+9edAbem7MnZ fO1A== X-Gm-Message-State: AHQUAubo/cgImgeBDuEmHXZz1nUNOubPI7KTCZaUuFaTcmcIRZyn0Cgt 5jL8M8b+Vt3IZKj072hCWKyyoTFs X-Google-Smtp-Source: AHgI3IYqEfJRnXT0rhu/tZg97UE1zCU4RkQCr4lGJD+MRuQVhcEFQmlvBYvdQvS1BK+mqyb6CIzSag== X-Received: by 2002:aed:2151:: with SMTP id 75mr21549704qtc.24.1550551038715; Mon, 18 Feb 2019 20:37:18 -0800 (PST) Received: from willemb1.nyc.corp.google.com ([2620:0:1003:315:3fa1:a34c:1128:1d39]) by smtp.gmail.com with ESMTPSA id d63sm12362249qka.22.2019.02.18.20.37.17 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 18 Feb 2019 20:37:18 -0800 (PST) From: Willem de Bruijn To: netdev@vger.kernel.org Cc: davem@davemloft.net, Willem de Bruijn Subject: [PATCH net] net: avoid false positives in untrusted gso validation Date: Mon, 18 Feb 2019 23:37:12 -0500 Message-Id: <20190219043712.97121-1-willemdebruijn.kernel@gmail.com> X-Mailer: git-send-email 2.21.0.rc0.258.g878e2cd30e-goog MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Willem de Bruijn GSO packets with vnet_hdr must conform to a small set of gso_types. The below commit uses flow dissection to drop packets that do not. But it has false positives when the skb is not fully initialized. Dissection needs skb->protocol and skb->network_header. Infer skb->protocol from gso_type as the two must agree. SKB_GSO_UDP can use both ipv4 and ipv6, so try both. Exclude callers for which network header offset is not known. Fixes: d5be7f632bad ("net: validate untrusted gso packets without csum offload") Signed-off-by: Willem de Bruijn --- include/linux/virtio_net.h | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h index 71f2394abbf7..e0348cb0a1dd 100644 --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -61,10 +61,20 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, /* gso packets without NEEDS_CSUM do not set transport_offset. * probe and drop if does not match one of the above types. */ - if (gso_type) { + if (gso_type && skb->network_header) { + if (!skb->protocol) + virtio_net_hdr_set_proto(skb, hdr); +retry: skb_probe_transport_header(skb, -1); - if (!skb_transport_header_was_set(skb)) + if (!skb_transport_header_was_set(skb)) { + /* UFO does not specify ipv4 or 6: try both */ + if (gso_type & SKB_GSO_UDP && + skb->protocol == htons(ETH_P_IP)) { + skb->protocol = htons(ETH_P_IPV6); + goto retry; + } return -EINVAL; + } } } -- 2.21.0.rc0.258.g878e2cd30e-goog