[PATCH net v6 0/3] net: virtio: validate outer protocol of UDP tunnel GSO packets

[Eric Dumazet <edumazet@kernel.org>]

virtio_net_hdr_tnl_to_skb() does not check that a UDP tunnel GSO
packet really has outer IPv4/IPv6 and UDP headers matching the
declared tunnel type. A guest, or any tap writer, can send a frame
with another outer ethertype (NSH in the report), and the GSO stack
then builds segments with skb->data before skb->head. The host
crashes in skb_under_panic() as soon as a header is pushed.

Patch 1 fixes the producer side, virtio_net_hdr_tnl_from_skb(), for
VLAN tagged packets:
- the tunnel offsets did not account for the VLAN tag tun inserts in
  the frame, and were 4 bytes short.
- the outer family came from skb->protocol, which is the VLAN protocol
  when the tag is in the packet data, so an outer IPv6 header was
  reported as IPv4.
Without it, patch 3 would drop such packets. Kernels without this fix
still send such headers, so it should go to stable along with patch 3.

Patch 2 clears a stale skb->protocol left on recycled NAPI frags skbs,
which could make the checks of patch 3 reject valid frames.

Patch 3 validates the outer headers, using the parsing helpers from
Michael's series "net: resolve uncommon partial checksums at ingress",
as Willem suggested. The callers tell whether frames start with an
Ethernet header, as the device type of a tun device can be changed
with TUNSETLINK. The rest of Michael's series (checksum validation and
completion) is left to him.

The selftests of v3 will follow in a separate series, with the fixes
Sashiko found in them.

v6:
- Patch 1: also take the outer family from vlan_get_protocol()
  instead of skb->protocol (Sashiko). New title.
- Move the tun skb->protocol fix (now patch 2) before the outer
  protocol check (now patch 3), so that no commit rejects valid frames
  (Sashiko). Reword its changelog accordingly.
- No change to patch 3.

v5: https://lore.kernel.org/netdev/20261109163507.3102091-1-edumazet@kernel.org/
- New patch 1: account for the VLAN tag in the tunnel offsets built by
  virtio_net_hdr_tnl_from_skb() (Sashiko).
- Patch 2: add Michael's Acked-by, no code change.

v4: https://lore.kernel.org/netdev/20261106095340.2113683-1-edumazet@kernel.org/
- Squash v3 patch 2 into patch 1 (Willem). Dropped Michael's Acked-by,
  as virtio_net_l3_start() now takes a has_eth argument.
- Patch 2: clear skb->protocol in tun_napi_alloc_frags(), the only
  place that needs it (Willem).
- Drop the selftests from this series (Willem).

v3: https://lore.kernel.org/netdev/20261105115715.1466924-1-edumazet@kernel.org/
- Patch 1: fix a comment, ipv6_find_hdr() stops at AH (Sashiko).
- New patch 2: do not use the device type to find the outer L3 header,
  TUNSETLINK can change it (Sashiko).
- New patch 3: clear a stale skb->protocol on IFF_NAPI_FRAGS skbs
  (Sashiko).
- More selftests, and big-endian fixes for them (Sashiko).

v2: https://lore.kernel.org/netdev/20261104050131.629967-1-edumazet@kernel.org/
- Use Michael's helpers instead of a new one: find the L3 header from
  the device type instead of assuming Ethernet when skb->protocol is
  unset, do not trust skb->protocol when it disagrees with the frame,
  and require UDP exactly at outer_th_offset. Stop at IPv6 AH headers
  (Willem).
- Selftest fixes, IFF_TUN tests.

v1: https://lore.kernel.org/netdev/20261103203113.550604-1-edumazet@kernel.org/

Eric Dumazet (3):
  net: virtio: fix UDP tunnel GSO header of VLAN tagged packets
  tun: clear stale skb->protocol of NAPI frags skbs
  net: virtio: validate outer protocol of UDP tunnel GSO packets

 drivers/net/tun.c          |  15 ++-
 drivers/net/tun_vnet.h     |   5 +-
 drivers/net/virtio_net.c   |   2 +-
 include/linux/virtio_net.h | 181 ++++++++++++++++++++++++++++++++++++-
 4 files changed, 195 insertions(+), 8 deletions(-)


base-commit: fdca4b030c78fa2773a94fda3a6dc3ce5558a727
-- 
2.53.0