[PATCH net v3 4/8] virtio_net: parse tunnel csum_start little-endian

["Michael S. Tsirkin" <mst@redhat.com>]

<glm>
The tunnel header format is only produced by standard-compliant
devices, so all of its fields, csum_start included, are
little-endian.  The nested virtio net header import already
parsed csum_start that way, but the inner transport offset was
parsed with the endianness specified by the interface.

On an interface in legacy big-endian mode the two parses of the
same field disagreed, and the value stored in
skb->inner_transport_header - which is only bounds-checked from
below - could point past the end of the packet, where GSO
segmentation later dereferences it.
</glm>

Parse the field little-endian in both places.

Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
Cc: Paolo Abeni <pabeni@redhat.com>
Assisted-by: LLM
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/linux/virtio_net.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index d6466f96cdd0..013c6c7e2dea 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -324,7 +324,7 @@ virtio_net_hdr_tnl_to_skb(struct sk_buff *skb,
 	inner_l3min = virtio_l3min(inner_isv6);
 	outer_l3min = ETH_HLEN + virtio_l3min(outer_isv6);
 
-	inner_th = __virtio16_to_cpu(little_endian, hdr->csum_start);
+	inner_th = __virtio16_to_cpu(true, hdr->csum_start);
 	inner_nh = le16_to_cpu(vhdr->inner_nh_offset);
 	outer_th = le16_to_cpu(vhdr->outer_th_offset);
 	if (outer_th < outer_l3min ||
-- 
MST