[PATCH net] net: virtio_net: decode tunnel csum_start as little-endian

[Cheng Yongkang]

virtio_net_hdr_tnl_to_skb() decodes hdr->csum_start with the caller's
little_endian argument when it validates the inner header offsets, but
then calls __virtio_net_hdr_to_skb() with little_endian hard-coded to
true.  The other tunnel offsets are always decoded as little-endian as
well.

tun passes tun_vnet_is_little_endian(), which is false when the device
uses big-endian legacy headers: by default on big-endian hosts, and
after TUNSETVNETBE on little-endian hosts with CONFIG_TUN_VNET_CROSS_LE.
The validation and the parser then disagree on csum_start.  For
example, the bytes 14 00 decode as 5120 for the validation and as 20
for the parser, so an inner_nh_offset beyond the data pulled into the
linear area passes the check, and the USO branch reads iphdr->version
out of bounds:

  BUG: KASAN: slab-out-of-bounds in tun_vnet_hdr_tnl_to_skb+0x74b/0x830
  Read of size 1 at addr ffff88807999d044 by task kvd-program/9399
  Call Trace:
   tun_vnet_hdr_tnl_to_skb+0x74b/0x830
   tun_get_user+0x1827/0x3d00
   tun_chr_write_iter+0x113/0x200
   vfs_write+0x5c9/0xb30

Decode csum_start as little-endian, matching the parser.  Callers that
pass little_endian == true are unaffected.

Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.")
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@xxxxxxxxx>
---
 include/linux/virtio_net.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index d6466f96cdd0..ddc6341747e5 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -324,7 +324,7 @@ virtio_net_hdr_tnl_to_skb(struct sk_buff *skb,
 	inner_l3min = virtio_l3min(inner_isv6);
 	outer_l3min = ETH_HLEN + virtio_l3min(outer_isv6);
 
-	inner_th = __virtio16_to_cpu(little_endian, hdr->csum_start);
+	inner_th = le16_to_cpu(hdr->csum_start);
 	inner_nh = le16_to_cpu(vhdr->inner_nh_offset);
 	outer_th = le16_to_cpu(vhdr->outer_th_offset);
 	if (outer_th < outer_l3min ||

base-commit: f4377bf85887f57b59abb5479f7660a81ffe4449
-- 
2.34.1