net: gso: fix tcp fraglist segmentation after pull from frag_list

Detect tcp gso fraglist skbs with corrupted geometry (see below) and
pass these to skb_segment instead of skb_segment_list, as the first
can segment them correctly.

Valid SKB_GSO_FRAGLIST skbs
- consist of two or more segments
- the head_skb holds the protocol headers plus first gso_size
- one or more frag_list skbs hold exactly one segment
- all but the last must be gso_size

Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can
modify these skbs, breaking these invariants.

In extreme cases they pull all data into skb linear. For TCP, this
causes a NULL ptr deref in __tcpv4_gso_segment_list_csum at
tcp_hdr(seg->next).

Detect invalid geometry due to pull, by checking head_skb size.
Don't just drop, as this may blackhole a destination. Convert to be
able to pass to regular skb_segment.

Approach and description based on a patch by Willem de Bruijn.

Link: https://lore.kernel.org/netdev/20240428142913.18666-1-shiming.cheng@mediatek.com/
Link: https://lore.kernel.org/netdev/20240922150450.3873767-1-willemdebruijn.kernel@gmail.com/
Fixes: bee88cd5bd83 ("net: add support for segmenting TCP fraglist GSO packets")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20240926085315.51524-1-nbd@nbd.name
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index e4ad3311e14895ab898a653c3a29cd8af3e42dff..2308665b51c5388814e5b61a262a1636d897c4a9 100644 (file)
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -101,8 +101,14 @@ static struct sk_buff *tcp4_gso_segment(struct sk_buff *skb,
        if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
                return ERR_PTR(-EINVAL);
 
-       if (skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST)
-               return __tcp4_gso_segment_list(skb, features);
+       if (skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST) {
+               struct tcphdr *th = tcp_hdr(skb);
+
+               if (skb_pagelen(skb) - th->doff * 4 == skb_shinfo(skb)->gso_size)
+                       return __tcp4_gso_segment_list(skb, features);
+
+               skb->ip_summed = CHECKSUM_NONE;
+       }
 
        if (unlikely(skb->ip_summed != CHECKSUM_PARTIAL)) {
                const struct iphdr *iph = ip_hdr(skb);

diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
index 23971903e66de82d2232def158d5faf3885c3d5a..a45bf17cb2a172d4612cb42f51481b97bbf364cd 100644 (file)
--- a/net/ipv6/tcpv6_offload.c
+++ b/net/ipv6/tcpv6_offload.c
@@ -159,8 +159,14 @@ static struct sk_buff *tcp6_gso_segment(struct sk_buff *skb,
        if (!pskb_may_pull(skb, sizeof(*th)))
                return ERR_PTR(-EINVAL);
 
-       if (skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST)
-               return __tcp6_gso_segment_list(skb, features);
+       if (skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST) {
+               struct tcphdr *th = tcp_hdr(skb);
+
+               if (skb_pagelen(skb) - th->doff * 4 == skb_shinfo(skb)->gso_size)
+                       return __tcp6_gso_segment_list(skb, features);
+
+               skb->ip_summed = CHECKSUM_NONE;
+       }
 
        if (unlikely(skb->ip_summed != CHECKSUM_PARTIAL)) {
                const struct ipv6hdr *ipv6h = ipv6_hdr(skb);