> <glm>
> The tunnel header format is only produced by standard-compliant
> devices, so all of its fields, csum_start included, are
> little-endian. The nested virtio net header import already
> parsed csum_start that way, but the inner transport offset was
> parsed with the endianness specified by the interface.
>
> On an interface in legacy big-endian mode the two parses of the
> same field disagreed, and the value stored in
> skb->inner_transport_header - which is only bounds-checked from
> below - could point past the end of the packet, where GSO
> segmentation later dereferences it.
> </glm>
>
> Parse the field little-endian in both places.
>
> Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO
> tunneling.")
> Cc: Paolo Abeni <[email protected]>
> Assisted-by: LLM
> Signed-off-by: Michael S. Tsirkin <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=4
