Re: [PATCH net-next 0/4] more virtio-net csum hardening

[Chris Arges <carges@cloudflare.com>]

On 2026-10-13 07:05:34, Michael S. Tsirkin wrote:
> On Tue, Oct 13, 2026 at 06:58:28AM -0400, Michael S. Tsirkin wrote:
> > Allowing untrusted hardware to specify csum start/offset for
> > CHECKSUM_PARTIAL was not a good idea, because, if it edits the packet
> > outside the actual checksum, and depending on the setup, the networking
> > stack could be looking at the packet both before and after the edit, and
> > seeing different results.
> > 
> > Previously, commit 6785011f8b16 ("ipv4: validate checksum_start before
> > completing checksum") validated all known instances where this
> > causes the most grief, but the real fix is to make sure
> > that either only actual checksum fields are ever edited,
> > or the checksum is completed before the net stack looks at it,
> > so it is always consistent.
> > 
> > This basically does this: checksum at ingress, except in a narrow list
> > of specified known good cases.
> > 
> > Fixes: f43798c27684 ("tun: Allow GSO using virtio_net_hdr")
> 
> 
> I forgot.
> 
> Reported-by: Paulos Yibelo <habte.yibelo@gmail.com>
> Reported-by: Chris Arges <carges@cloudflare.com>
> 
>
I did some testing of this patch-set and it mitigates my cases in VM
testing.

Tested-by: Chris Arges <carges@cloudflare.com>

> > Michael S. Tsirkin (4):
> >   net: add ip4_parse()
> >   net: use ip4_parse() in receive validation
> >   net: resolve uncommon partial checksums at ingress
> >   net: account for ingress-resolved virtio net hdr state
> > 
> >  drivers/net/tap.c                   |   4 +-
> >  drivers/net/tun.c                   |  44 +++++++-
> >  drivers/net/virtio_net.c            |   2 +-
> >  include/linux/ip.h                  |  24 +++++
> >  include/linux/virtio_net.h          | 161 ++++++++++++++++++++++++----
> >  net/bridge/br_netfilter_hooks.c     |  15 +--
> >  net/ipv4/ip_input.c                 |  13 +--
> >  net/ipv4/netfilter/nf_reject_ipv4.c |  13 +--
> >  net/packet/af_packet.c              |   4 +-
> >  9 files changed, 228 insertions(+), 52 deletions(-)
> > 
> > -- 
> > MST
> > 
>