> All tunnel related virtio features are > 32, so none of this
> functionality can be enabled on legacy mixed-endian device.
>
> Accordingly, all tunnel header fields, csum_start included, are
> little-endian.
>
> The nested virtio net header import parses csum_start that way, but the
> inner transport offset is parsed with the endianness specified by the
> interface.
>
> If tun is misconfigured to legacy big-endian mode while the tunnel
> features are enabled, the two parses of this field disagree, and the
> value stored in skb->inner_transport_header - which is only
> bounds-checked from below - can point past the end of the packet, where
> GSO segmentation later dereferences it.
>
> To fix, parse the field little-endian in both places.
>
> Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO
> tunneling.")
> Cc: Paolo Abeni <[email protected]>
> Signed-off-by: Michael S. Tsirkin <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=3
