[PATCH net] net: virtio_net: decode tunnel csum_start as little-endian

[PATCH net] net: virtio_net: decode tunnel csum_start as little-endian

[Cheng Yongkang]

virtio_net_hdr_tnl_to_skb() decodes hdr->csum_start with the caller's
little_endian argument when it validates the inner header offsets, but
then calls __virtio_net_hdr_to_skb() with little_endian hard-coded to
true.  The other tunnel offsets are always decoded as little-endian as
well.

tun passes tun_vnet_is_little_endian(), which is false when the device
uses big-endian legacy headers: by default on big-endian hosts, and
after TUNSETVNETBE on little-endian hosts with CONFIG_TUN_VNET_CROSS_LE.
The validation and the parser then disagree on csum_start.  For
example, the bytes 14 00 decode as 5120 for the validation and as 20
for the parser, so an inner_nh_offset beyond the data pulled into the
linear area passes the check, and the USO branch reads iphdr->version
out of bounds:

  BUG: KASAN: slab-out-of-bounds in tun_vnet_hdr_tnl_to_skb+0x74b/0x830
  Read of size 1 at addr ffff88807999d044 by task kvd-program/9399
  Call Trace:
   tun_vnet_hdr_tnl_to_skb+0x74b/0x830
   tun_get_user+0x1827/0x3d00
   tun_chr_write_iter+0x113/0x200
   vfs_write+0x5c9/0xb30

Decode csum_start as little-endian, matching the parser.  Callers that
pass little_endian == true are unaffected.

Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
---
 include/linux/virtio_net.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index d6466f96cdd0..ddc6341747e5 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -324,7 +324,7 @@ virtio_net_hdr_tnl_to_skb(struct sk_buff *skb,
 	inner_l3min = virtio_l3min(inner_isv6);
 	outer_l3min = ETH_HLEN + virtio_l3min(outer_isv6);
 
-	inner_th = __virtio16_to_cpu(little_endian, hdr->csum_start);
+	inner_th = le16_to_cpu(hdr->csum_start);
 	inner_nh = le16_to_cpu(vhdr->inner_nh_offset);
 	outer_th = le16_to_cpu(vhdr->outer_th_offset);
 	if (outer_th < outer_l3min ||

base-commit: f4377bf85887f57b59abb5479f7660a81ffe4449
-- 
2.34.1

Re: [PATCH net] net: virtio_net: decode tunnel csum_start as little-endian

[Michael S. Tsirkin]

On Thu, Oct 22, 2026 at 08:26:48AM -0700, Cheng Yongkang wrote:
> virtio_net_hdr_tnl_to_skb() decodes hdr->csum_start with the caller's
> little_endian argument when it validates the inner header offsets, but
> then calls __virtio_net_hdr_to_skb() with little_endian hard-coded to
> true.  The other tunnel offsets are always decoded as little-endian as
> well.
> 
> tun passes tun_vnet_is_little_endian(), which is false when the device
> uses big-endian legacy headers: by default on big-endian hosts, and
> after TUNSETVNETBE on little-endian hosts with CONFIG_TUN_VNET_CROSS_LE.
> The validation and the parser then disagree on csum_start.  For
> example, the bytes 14 00 decode as 5120 for the validation and as 20
> for the parser, so an inner_nh_offset beyond the data pulled into the
> linear area passes the check, and the USO branch reads iphdr->version
> out of bounds:
> 
>   BUG: KASAN: slab-out-of-bounds in tun_vnet_hdr_tnl_to_skb+0x74b/0x830
>   Read of size 1 at addr ffff88807999d044 by task kvd-program/9399
>   Call Trace:
>    tun_vnet_hdr_tnl_to_skb+0x74b/0x830
>    tun_get_user+0x1827/0x3d00
>    tun_chr_write_iter+0x113/0x200
>    vfs_write+0x5c9/0xb30
> 
> Decode csum_start as little-endian, matching the parser.  Callers that
> pass little_endian == true are unaffected.
> 
> Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
> Assisted-by: LLM
> Signed-off-by: Cheng Yongkang <teel4res@gmail.com>


duplicate of
dfcede18b8d54519bf586b8e5099e89ec63bf014.1792668082.git.mst@redhat.com ?

> ---
>  include/linux/virtio_net.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
> index d6466f96cdd0..ddc6341747e5 100644
> --- a/include/linux/virtio_net.h
> +++ b/include/linux/virtio_net.h
> @@ -324,7 +324,7 @@ virtio_net_hdr_tnl_to_skb(struct sk_buff *skb,
>  	inner_l3min = virtio_l3min(inner_isv6);
>  	outer_l3min = ETH_HLEN + virtio_l3min(outer_isv6);
>  
> -	inner_th = __virtio16_to_cpu(little_endian, hdr->csum_start);
> +	inner_th = le16_to_cpu(hdr->csum_start);
>  	inner_nh = le16_to_cpu(vhdr->inner_nh_offset);
>  	outer_th = le16_to_cpu(vhdr->outer_th_offset);
>  	if (outer_th < outer_l3min ||
> 
> base-commit: f4377bf85887f57b59abb5479f7660a81ffe4449
> -- 
> 2.34.1