[PATCH net-next 0/3] Guard against gso_segs overflows

[PATCH net-next 0/3] Guard against gso_segs overflows

[Alice Mikityanska]

From: Alice Mikityanska <alice@isovalent.com>

This series is a follow-up on the discussion:

https://lore.kernel.org/netdev/CAD0BsJWzSr2zduf5v3mVC4zd=Lj6ZAoC+V42-VBdg42aDY8XXw@mail.gmail.com/T/#m1e22fca273c36cc8844e516505d3251cc1418fea

skb_segment is patched to avoid possible overflows in partial GSO. The
possible sources of too many GSO segments are also addressed:

- virtio-net blocks large packets (>64k) with extremely small (<8)
  gso_size.
- GRO aggregation checks the number of segments before extending the
  chain.

Feel free to drop patch 1 if you feel that patches 2 and 3 address all
possible cases, and extra robustness in skb_segment is not needed.

Alice Mikityanska (3):
  net: Guard for gso_segs overflow in skb_segment
  virtio-net: Block malformed packets that overflow gso_segs
  net: Limit to GSO_MAX_SEGS in skb_gro_receive

 include/linux/virtio_net.h | 4 ++++
 net/core/gro.c             | 3 +++
 net/core/skbuff.c          | 2 +-
 3 files changed, 8 insertions(+), 1 deletion(-)

-- 
2.55.0

[PATCH net-next 1/3] net: Guard for gso_segs overflow in skb_segment

[Alice Mikityanska]

From: Alice Mikityanska <alice@isovalent.com>

skb_segment calculates 32-bit partial_segs as len / gso_size, and then
assigns it to the 16-bit gso_segs field. The division might overflow in
some edge cases where the SKB is BIG TCP (65536 <= len <= 8*65535), and
gso_size < TCP_MIN_GSO_SIZE = 8. While normally this can't happen due to
TCP_MIN_GSO_SIZE, an AF_PACKET PACKET_VNET_HDR socket can generate such
a malformed packet.

Blocking malformed virtio_net packets is implemented in the next patch,
but this patch clamps partial_segs in skb_segment itself for more
generic robustness. Should len / gso_size happen to be bigger than
65535 in partial GSO, skb_segment will now just produce more than two
output SKBs, all of which will be valid with gso_segs <= 65535.

Signed-off-by: Alice Mikityanska <alice@isovalent.com>
---
 net/core/skbuff.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d7d53a7c58f6..da6f8342b619 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4854,7 +4854,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
 		 * doesn't fit into an MSS sized block, so take care of that
 		 * now.
 		 */
-		partial_segs = len / mss;
+		partial_segs = min(len / mss, GSO_MAX_SEGS);
 		if (partial_segs > 1)
 			mss *= partial_segs;
 		else
-- 
2.55.0

[PATCH net-next 2/3] virtio-net: Block malformed packets that overflow gso_segs

[Alice Mikityanska]

From: Alice Mikityanska <alice@isovalent.com>

The user can specify any gso_size in a packet crafted with an AF_PACKET
PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the
same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user
crafts a packet with gso_size < 8, there is a risk for partial GSO to
overflow the 16-bit gso_segs field when dividing the SKB length by
gso_size.

While the previous commit added a generic guard to skb_segment, block
such malformed packets in this commit altogether.

Signed-off-by: Alice Mikityanska <alice@isovalent.com>
---
 include/linux/virtio_net.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index f36d21b5bc19..11ac9460b16b 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -188,6 +188,10 @@ static inline int __virtio_net_hdr_to_skb(struct sk_buff *skb,
 
 		/* Too small packets are not really GSO ones. */
 		if (skb->len - nh_off > gso_size) {
+			/* Block packets that would cause a gso_segs overflow. */
+			if (unlikely(skb->len - nh_off > gso_size * GSO_MAX_SEGS))
+				return -EINVAL;
+
 			shinfo->gso_size = gso_size;
 			shinfo->gso_type = gso_type;
 
-- 
2.55.0

Re: [PATCH net-next 2/3] virtio-net: Block malformed packets that overflow gso_segs

[Eric Dumazet]

On Thu, Jul 23, 2026 at 5:52 PM Alice Mikityanska
<alice.kernel@fastmail.im> wrote:
>
> From: Alice Mikityanska <alice@isovalent.com>
>
> The user can specify any gso_size in a packet crafted with an AF_PACKET
> PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the
> same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user
> crafts a packet with gso_size < 8, there is a risk for partial GSO to
> overflow the 16-bit gso_segs field when dividing the SKB length by
> gso_size.
>
> While the previous commit added a generic guard to skb_segment, block
> such malformed packets in this commit altogether.

Too much code in GRO fast path.

Have you considered silently setting gso_size to max(TCP_MIN_GSO_SIZE, gso_size)

[PATCH net-next 3/3] net: Limit to GSO_MAX_SEGS in skb_gro_receive

[Alice Mikityanska]

From: Alice Mikityanska <alice@isovalent.com>

NAPI_GRO_CB(skb)->count is a 16-bit field used during GRO aggregation,
which gets assigned to skb_shinfo(skb)->gso_segs upon GRO completion.
While doing GRO aggregation in skb_gro_receive, make sure we don't
overflow this field.

Subtraction is intentional to avoid overflow.

Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Assisted-by: Codex:GPT-5.6
---
 net/core/gro.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/core/gro.c b/net/core/gro.c
index 35f2f708f010..1a9d2a4f9a80 100644
--- a/net/core/gro.c
+++ b/net/core/gro.c
@@ -126,6 +126,9 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
 	lp = NAPI_GRO_CB(p)->last;
 	pinfo = skb_shinfo(lp);
 
+	if (unlikely(segs > GSO_MAX_SEGS - NAPI_GRO_CB(p)->count))
+		return -E2BIG;
+
 	if (headlen <= offset) {
 		skb_frag_t *frag;
 		skb_frag_t *frag2;
-- 
2.55.0