[PATCH net v3 1/2] net: gro: do not undo remote checksum offload on merged packets

[Eric Dumazet <edumazet@kernel.org>]

skb_gro_flush_final_remcsum() calls skb_gro_remcsum_cleanup() to undo
the checksum adjustment done by skb_gro_remcsum_process() when the
packet was not consumed by GRO.

When the inner handler merged the packet (NAPI_GRO_CB(skb)->same_flow
is set), grc->offset can no longer be trusted:

- skb_gro_receive() either gives the frags or the head of the skb
  to the held packet, or uses __skb_pull(skb, offset) before adding
  the skb to the frag_list of the held packet.

- skb_gro_receive_list() uses skb_pull(skb, skb_gro_offset(skb)).

grc->offset is relative to the original skb->data, so the 2-byte
read-modify-write done by skb_gro_remcsum_cleanup() can land in
the payload of a packet which now belongs to the GRO packet.
pskb_may_pull() can also be called on this frag_list member.

With fraglist GRO, this can also be a use-after-free:
pskb_may_pull(skb, skb_gro_offset(skb)) in skb_gro_receive_list()
or udp_gro_receive_segment() releases the first page fragment if it
only contains headers. NAPI_GRO_CB(skb)->frag0 and frag0_len are not
updated, so skb_gro_remcsum_cleanup() takes the fast path and writes
through frag0 into a page the skb no longer holds a reference on.
The non merged case, where frag0 is used after this pull, is handled
in the following patch.

For skbs merged by skb_gro_receive(), the cleanup can be skipped:
the skb is freed, or its headers are rebuilt from the head skb in
skb_segment().

Fraglist members need the cleanup: skb_segment_list() only copies the
link-layer and tunnel headers from the head skb, so members keep their
own inner headers, with the adjusted checksum. A forwarded VXLAN or GUE
packet would then leave with a modified inner checksum, and since
__copy_skb_header() copies the cleared remcsum_offload bit of the head
skb, gue_remcsum() or vxlan_remcsum() would adjust it a second time.
skb_gro_receive_list() pulled the headers in the linear part before
moving skb->data past them, so restore the checksum there.
The remote checksum start and offset come from the packet: only
restore the checksum if it is part of these headers, which is the
case for a valid packet, where it belongs to the inner transport
header. Otherwise the write could land past the linear part.

This affects VXLAN (VXLAN_F_REMCSUM_NOPARTIAL) and GUE
(FOU_F_REMCSUM_NOPARTIAL).

This was found while fixing a report from Taesoo Kim and Cen Zhang,
who used LLM assisted code analysis and provided reproducers.

Fixes: 26c4f7da3e41 ("net: Fix remcsum in GRO path to not change packet")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
 include/net/gro.h | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/include/net/gro.h b/include/net/gro.h
index 2300b6da05b2..13a8ef217a1d 100644
--- a/include/net/gro.h
+++ b/include/net/gro.h
@@ -354,6 +354,23 @@ static inline void skb_gro_remcsum_cleanup(struct sk_buff *skb,
 	if (!grc->delta)
 		return;
 
+	if (NAPI_GRO_CB(skb)->same_flow) {
+		/* skb_segment_list() keeps the inner headers of fraglist
+		 * members: restore their checksum. skb_gro_receive_list()
+		 * pulled these headers, then moved skb->data past them.
+		 * A valid remote checksum offset points to the inner
+		 * transport header, which is part of these headers.
+		 * Headers of other merged skbs are not used anymore.
+		 */
+		if (NAPI_GRO_CB(skb)->is_flist &&
+		    grc->offset + sizeof(u16) <= skb_gro_offset(skb))
+			remcsum_unadjust((__sum16 *)(skb->data -
+						     skb_gro_offset(skb) +
+						     grc->offset),
+					 grc->delta);
+		return;
+	}
+
 	ptr = skb_gro_header(skb, plen, grc->offset);
 	if (!ptr)
 		return;
-- 
2.53.0