Re: [PATCH RFC v7 3/5] virtio_net: parse tunnel csum_start little-endian

[sashiko-bot@kernel.org]

> All tunnel related virtio features are > 32, so none of this
> functionality can be enabled on legacy mixed-endian device.
> 
> Accordingly, all tunnel header fields, csum_start included, are
> little-endian.
> 
> The nested virtio net header import parses csum_start that way, but the
> inner transport offset is parsed with the endianness specified by the
> interface.
> 
> If tun is misconfigured to legacy big-endian mode while the tunnel
> features are enabled, the two parses of this field disagree, and the
> value stored in skb->inner_transport_header - which is only
> bounds-checked from below - can point past the end of the packet, where
> GSO segmentation later dereferences it.
> 
> To fix, parse the field little-endian in both places.
> 
> Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
> Cc: Paolo Abeni <pabeni@redhat.com>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/305bcadb19f4a539a318c6b87c829fbe43d0ffdb.1793276116.git.mst@redhat.com?part=3