[PATCH] net: validate checksum start before software fallback on transmit

[PATCH] net: validate checksum start before software fallback on transmit

[Dmitrii Iakunin]

Commit 6785011f8b16 ("ipv4: validate checksum_start before completing
checksum") added checks to prevent malformed checksum metadata from
causing software checksum completion to corrupt the IPv4 header.

skb_csum_hwoffload_help() can also complete checksums in software when
the available device features cannot satisfy the checksum request.
This path was not covered by the earlier validation.

For IPv4 packets, ensure that the fixed network header is accessible
and validate the checksum start before calling skb_checksum_help().
Return -EINVAL on failure so callers discard the packet rather than
complete the checksum using invalid metadata.

Leave hardware-offloaded checksums and SCTP CRC handling unchanged.

Fixes: 6785011f8b16 ("ipv4: validate checksum_start before completing checksum")
Signed-off-by: Dmitrii Iakunin <zeil@nebius.com>
---
 net/core/dev.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index 3ac700d37e59..77c40e914e5f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4130,6 +4130,11 @@ int skb_csum_hwoffload_help(struct sk_buff *skb,
 	}
 
 sw_checksum:
+	if (vlan_get_protocol(skb) == htons(ETH_P_IP)) {
+		if (!pskb_network_may_pull(skb, sizeof(struct iphdr)) ||
+		    ip_check_csum_start(skb))
+			return -EINVAL;
+	}
 	return skb_checksum_help(skb);
 }
 EXPORT_SYMBOL(skb_csum_hwoffload_help);
-- 
2.52.0

Re: [PATCH] net: validate checksum start before software fallback on transmit

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.