[PATCH net v3 0/8] net: virtio: validate outer protocol of UDP tunnel GSO packets

[Eric Dumazet <edumazet@kernel.org>]

virtio_net_hdr_tnl_to_skb() does not check that a UDP tunnel GSO
packet really has outer IPv4/IPv6 and UDP headers matching the
declared tunnel type. A guest, or any tap writer, can send a frame
with another outer ethertype (NSH in the report), and the GSO stack
then builds segments with skb->data before skb->head. The host
crashes in skb_under_panic() as soon as a header is pushed.

Patch 1 validates the outer headers, using the parsing helpers from
Michael's series "net: resolve uncommon partial checksums at ingress",
as Willem suggested. The rest of that series (checksum validation and
completion) is left to Michael.

Patch 2 lets the callers tell whether frames start with an Ethernet
header, instead of using the device type, which tun can change with
TUNSETLINK.

Patch 3 clears a stale skb->protocol left on recycled NAPI frags skbs,
which could make the checks of patch 1 reject valid frames.

Patch 4 fixes a selftest helper computing UDP checksums over a length
in network byte order.

Patches 5 to 7 add tun selftests, on tap and IFF_TUN devices: valid
outer IPv4/IPv6 frames are accepted; mismatched or non-UDP outer
headers and misplaced outer transport headers are rejected, also on
retyped devices.

Patch 8 makes the UDP tunnel selftests write the tunnel offsets of the
virtio header in little endian, so they work on big-endian hosts.

v3:
- Patch 1: fix a comment, ipv6_find_hdr() stops at AH (Sashiko).
- New patch 2, and its tests in patch 6: Sashiko found that changing
  the device type with TUNSETLINK bypasses the checks of patch 1.
- New patch 3: Sashiko found that napi_reuse_skb() leaves a stale
  skb->protocol on IFF_NAPI_FRAGS skbs.
- New patch 7: test cases Sashiko found missing in patch 5 (outer
  IPv6, VLAN with IPv6 or with a wrong outer_th_offset, non-UDP outer
  L4). Fixed the patch 5 changelog.
- New patch 8: big-endian hosts (Sashiko).
- Collected Reviewed-by and Acked-by tags.

v2: https://lore.kernel.org/netdev/20261104050131.629967-1-edumazet@kernel.org/
- Patch 1: use Michael's helpers instead of a new one: find the L3
  header from the device type instead of assuming Ethernet when
  skb->protocol is unset, do not trust skb->protocol when it disagrees
  with the frame, and require UDP exactly at outer_th_offset. Stop at
  IPv6 AH headers (Willem).
- Patch 2: clear udph->check before summing and send 0xffff instead
  of a zero checksum (Willem).
- Patch 3: clear the reused buffer before building each frame (Willem).
  Add IFF_TUN tests, where skb->protocol comes from the tun_pi header.

v1: https://lore.kernel.org/netdev/20261103203113.550604-1-edumazet@kernel.org/

Eric Dumazet (8):
  net: virtio: validate outer protocol of UDP tunnel GSO packets
  net: virtio: do not use dev->type to find the outer L3 header
  tun: clear stale skb->protocol of NAPI frags skbs
  selftests: net: tuntap: fix UDP checksum length in
    build_udp_packet_csum()
  selftests: net: tun: test outer protocol of UDP tunnel GSO packets
  selftests: net: tun: test UDP tunnel GSO on retyped devices
  selftests: net: tun: test more outer header mismatches of UDP tunnel
    GSO
  selftests: net: tuntap: write UDP tunnel offsets in little endian

 drivers/net/tun.c                            |  14 +-
 drivers/net/tun_vnet.h                       |   5 +-
 drivers/net/virtio_net.c                     |   2 +-
 include/linux/virtio_net.h                   | 169 +++++++
 tools/testing/selftests/net/tun.c            | 440 +++++++++++++++++++
 tools/testing/selftests/net/tuntap_helpers.h |  29 +-
 6 files changed, 649 insertions(+), 10 deletions(-)


base-commit: 37dfd0efbfffc20a57e41c2eb349ac49b1ca1ff8
-- 
2.53.0