On 9/19/26 6:47 PM, Paulos Yibelo wrote:
> ip_do_fragment() completes a CHECKSUM_PARTIAL skb before reading the IPv4
> header length. A virtualization interface can supply a checksum start that
> still points inside the IPv4 header after link-layer removal.
>
> This does not require a virtual-machine guest. A TUN device with
> virtio-net header support is sufficient to reach this path.
>
> skb_checksum_help() can then change iph->ihl after the packet was parsed
> and routed. Fragmentation trusts the changed IHL and can copy beyond the
> skb's logical linear head into transmitted IPv4 options.
>
> Read and validate IHL before checksum completion, reject a checksum start
> inside that header, retain the validated length, and reacquire iph after
> skb_checksum_help().
>
> Fixes: dbd3393c56a8 ("ipv4: add defensive check for CHECKSUM_PARTIAL skbs in
> ip_fragment")
> Reported-by: Paulos Yibelo <[email protected]>
> Cc: [email protected]
> Assisted-by: LLM
> Signed-off-by: Paulos Yibelo <[email protected]>
> Acked-by: Michael S. Tsirkin <[email protected]>
> ---
> Changes in v4:
> - State explicitly that a TUN device is sufficient and no guest is required,
> as noted by Michael S. Tsirkin. No code changes.
>
> Changes in v3:
> - No code changes.
>
> Changes in v2:
> - No code changes.
>
> net/ipv4/ip_output.c | 23 +++++++++++++++++------
> 1 file changed, 17 insertions(+), 6 deletions(-)
>
>
Reviewed-by: David Ahern <[email protected]>
