Skip to content

[rlc-10/6.12.0-211.65.1.el10_2] ipv4: validate checksum_start before completing checksum #1715

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bmastbergen merged 1 commit into from
Oct 19, 2026
Merged

[rlc-10/6.12.0-211.65.1.el10_2] ipv4: validate checksum_start before completing checksum #1715

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions include/net/ip.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,13 @@ static inline unsigned int ip_hdrlen(const struct sk_buff *skb)
return ip_hdr(skb)->ihl * 4;
}

static inline int ip_check_csum_start(const struct sk_buff *skb)
{
if (unlikely(skb->csum_start < skb->network_header + ip_hdrlen(skb)))
return -EINVAL;
return 0;
}

struct ipcm_cookie {
struct sockcm_cookie sockc;
__be32 addr;
Expand Down
10 changes: 7 additions & 3 deletions net/bridge/netfilter/nf_conntrack_bridge.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,13 @@ static int nf_br_ip_fragment(struct net *net, struct sock *sk,
int err = 0;

/* for offloaded checksums cleanup checksum before fragmentation */
if (skb->ip_summed == CHECKSUM_PARTIAL &&
(err = skb_checksum_help(skb)))
goto blackhole;
if (skb->ip_summed == CHECKSUM_PARTIAL) {
err = ip_check_csum_start(skb);
if (!err)
err = skb_checksum_help(skb);
if (err)
goto blackhole;
}

iph = ip_hdr(skb);

Expand Down
10 changes: 7 additions & 3 deletions net/ipv4/ip_output.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -779,9 +779,13 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
int err = 0;

/* for offloaded checksums cleanup checksum before fragmentation */
if (skb->ip_summed == CHECKSUM_PARTIAL &&
(err = skb_checksum_help(skb)))
goto fail;
if (skb->ip_summed == CHECKSUM_PARTIAL) {
err = ip_check_csum_start(skb);
if (!err)
err = skb_checksum_help(skb);
if (err)
goto fail;
}

/*
* Point into the IP datagram header.
Expand Down
7 changes: 7 additions & 0 deletions net/netfilter/nfnetlink_queue.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
#include <linux/rhashtable.h>
#include <linux/jhash.h>
#include <net/gso.h>
#include <net/ip.h>
#include <net/sock.h>
#include <net/tcp_states.h>
#include <net/netfilter/nf_queue.h>
Expand Down Expand Up @@ -607,6 +608,12 @@ static int nfqnl_put_bridge(struct nf_queue_entry *entry, struct sk_buff *skb)

static int nf_queue_checksum_help(struct sk_buff *entskb)
{
if (entskb->protocol == htons(ETH_P_IP)) {
if (!pskb_network_may_pull(entskb, sizeof(struct iphdr)) ||
ip_check_csum_start(entskb))
return -EINVAL;
}

if (skb_csum_is_sctp(entskb))
return skb_crc32c_csum_help(entskb);

Expand Down
6 changes: 5 additions & 1 deletion net/netfilter/xt_CHECKSUM.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@

#include <linux/netfilter_ipv4/ip_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <net/ip.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Michael S. Tsirkin <mst@redhat.com>");
Expand All @@ -25,8 +26,11 @@ MODULE_ALIAS("ip6t_CHECKSUM");
static unsigned int
checksum_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
if (skb->ip_summed == CHECKSUM_PARTIAL && !skb_is_gso(skb))
if (skb->ip_summed == CHECKSUM_PARTIAL && !skb_is_gso(skb)) {
if (xt_family(par) == NFPROTO_IPV4 && ip_check_csum_start(skb))
return NF_DROP;
skb_checksum_help(skb);
}

return XT_CONTINUE;
}
Expand Down
16 changes: 11 additions & 5 deletions net/xfrm/xfrm_output.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -816,16 +816,22 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb)
}

if (skb->ip_summed == CHECKSUM_PARTIAL) {
err = skb_checksum_help(skb);
if (err) {
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
kfree_skb(skb);
return err;
if (skb->protocol == htons(ETH_P_IP)) {
err = ip_check_csum_start(skb);
if (err)
goto error;
}
err = skb_checksum_help(skb);
if (err)
goto error;
}

out:
return xfrm_output2(net, sk, skb);
error:
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
kfree_skb(skb);
return err;
}
EXPORT_SYMBOL_GPL(xfrm_output);

Expand Down
Loading