github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-04 12:35:52 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
2e357f002c
linux/net
History
Björn Töpel 2e357f002c net: Avoid checksumming unreadable skb tail on trim 
pskb_trim_rcsum_slow() keeps CHECKSUM_COMPLETE valid by subtracting
the checksum of the bytes removed from the skb tail. That assumes the
removed bytes can be read.

io_uring zcrx skbs may contain unreadable net_iov frags. With fbnic
header/data split, small TCP/IPv4 packets can carry Ethernet padding
in such a frag. ip_rcv_core() trims the skb to iph->tot_len before TCP
sees it, and the CHECKSUM_COMPLETE adjustment then calls
skb_checksum() on the padding.

This is exposed by IPv4 because small TCP/IPv4 frames can be shorter
than the Ethernet minimum payload. TCP/IPv6 frames are large enough in
the normal zcrx path, so they do not hit the same padding trim.

Keep the existing checksum adjustment for readable skbs. If the
remaining packet is fully linear, drop CHECKSUM_COMPLETE and let the
stack validate the packet after trimming. If unreadable payload would
remain, fail the trim; the checksum cannot be adjusted without reading
the trimmed tail.

Also clear skb->unreadable when trimming removes all frags.

Fixes: 65249feb6b ("net: add support for skbs with unreadable frags")
Signed-off-by: Björn Töpel <bjorn@kernel.org>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260522120643.242974-1-bjorn@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-05-26 15:21:27 +02:00
..
6lowpan
9p 9p/trans_xen: replace simple_strto* with kstrtouint 2026-04-16 02:57:01 +00:00
802 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
8021q 8021q: delete cleared egress QoS mappings 2026-04-23 12:13:57 +02:00
appletalk net: appletalk: fix NULL pointer dereference in aarp_send_ddp() 2026-05-18 16:33:34 -07:00
atm net: atm: fix skb leak in sigd_send() default branch 2026-05-12 18:07:02 -07:00
batman-adv batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface 2026-05-19 10:43:54 +02:00
bluetooth Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() 2026-05-20 16:35:47 -04:00
bpf bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 2026-04-12 15:42:57 -07:00
bridge netfilter: ebtables: fix OOB read in compat_mtw_from_user 2026-05-22 12:28:46 +02:00
can Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
ceph libceph: Fix potential null-ptr-deref in decode_choose_args() 2026-05-12 21:00:59 +02:00
core net: Avoid checksumming unreadable skb tail on trim 2026-05-26 15:21:27 +02:00
dcb Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
devlink Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-04-09 13:20:59 -07:00
dns_resolver net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
dsa net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops 2026-04-16 19:10:48 -07:00
ethernet bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
ethtool ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics 2026-05-12 18:45:13 -07:00
handshake
hsr net: hsr: fix potential OOB access in supervision frame handling 2026-05-25 14:18:15 -07:00
ieee802154 net: remove addr_len argument of recvmsg() handlers 2026-03-02 18:17:17 -08:00
ife
ipv4 ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() 2026-05-22 19:05:31 -07:00
ipv6 ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). 2026-05-26 11:16:12 +02:00
iucv net/iucv: fix locking in .getsockopt 2026-05-22 17:40:32 -07:00
kcm kcm: fix zero-frag skb in frag_list on partial sendmsg error 2026-02-23 17:26:55 -08:00
key vfs-7.1-rc1.kino 2026-04-13 12:19:01 -07:00
l2tp l2tp: use list_del_rcu in l2tp_session_unhash 2026-05-21 08:47:20 -07:00
l3mdev
lapb
llc llc: Return -EINPROGRESS from llc_ui_connect() 2026-04-23 11:40:39 -07:00
mac80211 wifi: mac80211: consume only present negotiated TTLM maps 2026-05-20 11:20:37 +02:00
mac802154 bonding: prevent potential infinite loop in bond_header_parse() 2026-03-16 19:29:45 -07:00
mctp net: mctp: test: Use dev_direct_xmit for TX to our test device 2026-04-30 13:36:47 -07:00
mpls Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-04-02 11:03:13 -07:00
mptcp mptcp: update window_clamp on subflows when SO_RCVBUF is set 2026-05-19 15:36:35 +02:00
ncsi net: ncsi: fix skb leak in error paths 2026-03-06 17:34:48 -08:00
netfilter netfilter: nf_tables: fix dst corruption in same register operation 2026-05-22 12:28:46 +02:00
netlabel Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
netlink net: netlink: don't set nsid on local notifications 2026-05-22 17:11:09 -07:00
nfc NFC: digital: Bounds check NFC-A cascade depth in SDD response handler 2026-04-12 11:40:45 -07:00
nsh
openvswitch openvswitch: vport: fix race between linking and the device notifier 2026-05-18 16:38:45 -07:00
packet net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() 2026-04-22 20:16:34 -07:00
phonet phonet/pep: disable BH around forwarded sk_receive_skb() 2026-05-21 07:38:21 -07:00
psample
psp psp: strip variable-length PSP header in psp_dev_rcv() 2026-05-04 19:25:14 -07:00
qrtr Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2026-04-14 12:04:00 -07:00
rds rds_tcp: close NULL deref window in rds_tcp_set_callbacks 2026-05-14 17:06:59 -07:00
rfkill net: rfkill: prevent unlimited numbers of rfkill events from being created 2026-04-07 12:35:04 +02:00
rxrpc rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer 2026-05-20 16:36:45 -07:00
sched net/sched: sch_cbs: Call qdisc_reset for child qdisc 2026-05-13 17:53:39 -07:00
sctp sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL 2026-05-08 18:21:09 -07:00
shaper net: shaper: rework the VALID marking (again) 2026-05-20 16:34:20 -07:00
smc net/smc: Do not re-initialize smc hashtables 2026-05-22 17:38:02 -07:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-04-14 12:37:00 +02:00
sunrpc nfsd-7.1 fixes: 2026-05-15 13:11:41 -07:00
switchdev bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign 2026-03-19 13:14:00 +01:00
tipc Including fixes from Netfilter. 2026-04-23 16:50:42 -07:00
tls tls: Preserve sk_err across recvmsg() when data has been copied 2026-05-14 18:19:44 -07:00
unix af_unix: Fix UAF read of tail->len in unix_stream_data_wait() 2026-05-19 18:53:56 -07:00
vmw_vsock vsock/virtio: fix skb overhead overflow on 32-bit builds 2026-05-22 19:05:10 -07:00
wireless wifi: cfg80211: wext: validate chandef in monitor mode 2026-05-20 11:44:19 +02:00
x25 vfs-7.1-rc1.kino 2026-04-13 12:19:01 -07:00
xdp bpf-fixes 2026-05-09 18:42:54 -07:00
xfrm xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete 2026-04-29 11:27:34 +02:00
compat.c
devres.c
Kconfig net: remove ax25 and amateur radio (hamradio) subsystem 2026-04-23 10:24:02 -07:00
Kconfig.debug
Makefile net: remove ax25 and amateur radio (hamradio) subsystem 2026-04-23 10:24:02 -07:00
socket.c Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
sysctl_net.c