Re: [PATCH net v4 2/2] ipv4: reject partial checksums covering the IP header

[David Ahern]

On 9/19/26 6:47 PM, Paulos Yibelo wrote:
> ip_do_fragment() completes a CHECKSUM_PARTIAL skb before reading the IPv4
> header length. A virtualization interface can supply a checksum start that
> still points inside the IPv4 header after link-layer removal.
> 
> This does not require a virtual-machine guest. A TUN device with
> virtio-net header support is sufficient to reach this path.
> 
> skb_checksum_help() can then change iph->ihl after the packet was parsed
> and routed. Fragmentation trusts the changed IHL and can copy beyond the
> skb's logical linear head into transmitted IPv4 options.
> 
> Read and validate IHL before checksum completion, reject a checksum start
> inside that header, retain the validated length, and reacquire iph after
> skb_checksum_help().
> 
> Fixes: dbd3393c56a8 ("ipv4: add defensive check for CHECKSUM_PARTIAL skbs in ip_fragment")
> Reported-by: Paulos Yibelo <habte.yibelo@xxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Paulos Yibelo <habte.yibelo@xxxxxxxxx>
> Acked-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
> ---
> Changes in v4:
> - State explicitly that a TUN device is sufficient and no guest is required,
>   as noted by Michael S. Tsirkin. No code changes.
> 
> Changes in v3:
> - No code changes.
> 
> Changes in v2:
> - No code changes.
> 
>  net/ipv4/ip_output.c | 23 +++++++++++++++++------
>  1 file changed, 17 insertions(+), 6 deletions(-)
> 
>

Reviewed-by: David Ahern <dsahern@xxxxxxxxxx>