[PATCH net] net: gso: always scan dodgy frag_list for linear heads

[Guidong Han <2045gemini@gmail.com>]

skb_segment() moves frag_list data into the segments either by sharing
page frags (zero-copy, requires the source memory to be page backed)
or by copying. Sharing into a linear kmalloc head is invalid, so for
SKB_GSO_DODGY skbs (untrusted GSO metadata, e.g. from a virtio net
header supplied by a VM guest or an AF_PACKET/TUN user) the frag_list
gets a defensive scan: if any member has a linear head without
head_frag set, NETIF_F_SG is cleared to force the copying fallback.
Without it, segmentation dies at BUG_ON(!list_skb->head_frag).

The scan is skipped when mss == skb_headlen(head_skb), on the
assumption that the frag_list members then terminate on exact mss
boundaries, so segments never cut into the middle of a member and
page sharing stays safe. That assumption comes from GRO-built lists,
where every member holds exactly one received segment. It does not
hold in general: the first segment also contains head_skb's paged
frags, so even with mss == skb_headlen(head_skb) a frag_list member
need not start on an mss boundary.

Such a layout is reachable from a guest: it sends two IPv4 fragments
through virtio-net, the first with a forged gso_size equal to the
reassembled linear head length, and conntrack defrag appends the
second, kmalloc-backed fragment to the frag_list. Forwarding then
forces software GSO (gso_size > egress MTU, or the egress lacks
NETIF_F_FRAGLIST) and panics the host: an unprivileged guest can take
down the host and all co-located VMs. The same layout is reachable
from host userspace via AF_PACKET PACKET_VNET_HDR or TUN with
IFF_VNET_HDR, given any conntrack user.

Drop the mss != skb_headlen(head_skb) test so the scan runs for all
dodgy frag_list skbs.

Fixes: 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list")
Cc: stable@vger.kernel.org
Co-developed-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
Signed-off-by: Guidong Han <2045gemini@gmail.com>
---
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ba3dbac80fb4..e97b27ec13fd 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4796,7 +4796,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
 	int nfrags, pos;
 
 	if ((skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY) &&
-	    mss != GSO_BY_FRAGS && mss != skb_headlen(head_skb)) {
+	    mss != GSO_BY_FRAGS) {
 		struct sk_buff *check_skb;
 
 		for (check_skb = list_skb; check_skb; check_skb = check_skb->next) {
@@ -4804,11 +4804,13 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
 				/* gso_size is untrusted, and we have a frag_list with
 				 * a linear non head_frag item.
 				 *
-				 * If head_skb's headlen does not fit requested gso_size,
-				 * it means that the frag_list members do NOT terminate
-				 * on exact gso_size boundaries. Hence we cannot perform
-				 * skb_frag_t page sharing. Therefore we must fallback to
-				 * copying the frag_list skbs; we do so by disabling SG.
+				 * The frag_list members cannot be trusted to terminate
+				 * on exact gso_size boundaries: head_skb's paged frags
+				 * take part in the first segment, so even
+				 * mss == skb_headlen(head_skb) does not guarantee the
+				 * alignment. Hence we cannot perform skb_frag_t page
+				 * sharing. Therefore we must fallback to copying the
+				 * frag_list skbs; we do so by disabling SG.
 				 */
 				features &= ~NETIF_F_SG;
 				break;