[PATCH net 3/3] net: enetc: let core segment GSO super-skb when headers exceed TSO_HEADER_SIZE

[Vladimir Oltean <vladimir.oltean@nxp.com>]

Like many other drivers, both the software TSO path
(enetc_map_tx_tso_buffs()) and the LSO path (enetc_lso_map_hdr()) copy
the L2+L3+L4 headers of the skb into a fixed-size TSO_HEADER_SIZE (256
byte) slot of the per-ring dma_alloc_coherent() header area, without
checking that they fit.

Sashiko casually points out during review of an unrelated patch:
https://lore.kernel.org/netdev/179294166520.3134.18097439321876673016@kernel.org/
that TSO_HEADER_SIZE does not constitute the maximum size that packet
headers can have for GSO super-skbs, but rather, an essentially
arbitrary number.

An example where headers can exceed TSO_HEADER_SIZE is with an IPv6
extension named Segment Routing Header, set through setsockopt(IPV6_RTHDR),
with a type 4 routing header. With 11 or more segments, the headers of a
TCP/IPv6 packet exceed 256 bytes:

  Ethernet                14
  IPv6                    40
  SRH, 12 segments        8 + 12 * 16 = 200
  TCP (with timestamps)   32
                          ---
                          286  (30 bytes too many)

No privileges are required to request this socket option (but it will
cause driver writes outside allocated memory). A reproducer sketch can
be found at:
https://gist.github.com/vladimiroltean/7cecf636b788b29f361a2fbdae646010

Bizarrely, enetc is the only affected driver, because the core
accidentally protects most other drivers against this bug in
gso_features_check(). There, we have this logic that saves the day:

	/* NETIF_F_IPV6_CSUM does not support IPv6 extension headers,
	 * so neither does TSO that depends on it.
	 */
	if (features & NETIF_F_IPV6_CSUM &&
	    skb_has_ipv6_extension_hdr(skb))
		features &= ~(NETIF_F_IPV6_CSUM | NETIF_F_TSO6 | NETIF_F_GSO_UDP_L4);

enetc is the outlier because it only advertises the more complete
NETIF_F_HW_CSUM, so for it, this fixup does not clear the NETIF_F_TSO6
and NETIF_F_GSO_UDP_L4 bits.

[ astute reviewers may ask: what if we disable NETIF_F_IPV6_CSUM at
  runtime, via ethtool -k, so as to bypass this fixup, don't we make
  all drivers vulnerable?
  No, because netdev_fix_features() will trigger the code path which
  also prints "Dropping TSO6 features since no CSUM feature.\n".
  So TSO super-skbs will now be segmented in the stack. ]

Surveying every driver that uses `TSO_HEADER_SIZE`:

 Driver  | TSO6 | Checksum feature    | Core guard fires? | Verdict
 ---------------|---------------------|-------------------|---------
 enetc   | yes  | `NETIF_F_HW_CSUM`   | no                | vulnerable
 bnxt    | yes  | `NETIF_F_IPV6_CSUM` | yes               | safe
 nicvf   | yes  | `NETIF_F_IPV6_CSUM` | yes               | safe
 otx2    | yes  | `NETIF_F_IPV6_CSUM` | yes               | safe
 fec     | no   | `NETIF_F_IPV6_CSUM` | n/a               | safe
 mvneta  | no   | `NETIF_F_IPV6_CSUM` | n/a               | safe
 mvpp2   | no   | `NETIF_F_IPV6_CSUM` | n/a               | safe
 mv643xx | no   | `NETIF_F_IP_CSUM`   | n/a               | safe
 dpaa2   | no   | `NETIF_F_IPV6_CSUM` | n/a               | safe (*)

(*) dpaa2 also uses a fixed-size `kmalloc(TSO_HEADER_SIZE)` per segment,
so the identical overflow would apply if it ever gained `NETIF_F_TSO6`.

The above survey is what influenced the decision to make a localized
patch in enetc_features_check() rather than create a huge disturbance in
the core, even though, IMO, TSO_HEADER_SIZE is a huge foot gun.

Fixes: fb8629e2cbfc ("net: enetc: add support for software TSO")
Fixes: 69797ff888d3 ("net: enetc: add LSO support for i.MX95 ENETC PF")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
---
 drivers/net/ethernet/freescale/enetc/enetc.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
index 7f089a84d9a6..3c5478238e35 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc.c
@@ -1122,7 +1122,15 @@ netdev_features_t enetc_features_check(struct sk_buff *skb,
 
 	features = vlan_features_check(skb, features);
 
-	if (!skb_is_gso(skb) || enetc_skb_uses_lso(priv, skb))
+	if (!skb_is_gso(skb))
+		return features;
+
+	if (enetc_lso_get_hdr_len(skb) > TSO_HEADER_SIZE) {
+		features &= ~NETIF_F_GSO_MASK;
+		return features;
+	}
+
+	if (enetc_skb_uses_lso(priv, skb))
 		return features;
 
 	if (enetc_tso_count_descs(skb) >= priv->tx_bd_count)
-- 
2.53.0