Linux hardens virtio-net checksum offload against rogue metadata

Michael S. Tsirkin has sent a net-tree series that hardens how Linux accepts checksum offload metadata from virtio net headers, responding to a publicized class of bugs first reported by Paulos Yibelo and further exercised by others including Chris Arges of Cloudflare.

The flaw was architectural. Paths such as tun, tap, packet sockets, and virtio-net let untrusted devices or guests set csum start and offset for CHECKSUM_PARTIAL to any point in the frame. Later checksum completion could then rewrite bytes after the stack had already made protocol decisions on the packet, so different layers could see inconsistent contents depending on timing and setup. An earlier IPv4-only guard covered some of the worst cases; the real fix is to stop retaining arbitrary partial-checksum state.

Under the new rules, CHECKSUM_PARTIAL is kept only when the offsets match a parsed TCP or UDP header, including VLAN tags, IPv4 options, and IPv6 extension headers. Other non-GSO packets have their checksum completed in software before any protocol processing. GSO packets that cannot be recognized that way are dropped rather than segmented with untrusted metadata. UDP tunnel inner headers get the same treatment. A related tunnel bug, where mixed endian parsing of csum_start could leave the inner transport offset past the end of the packet and crash GSO, is corrected by always reading that field little-endian.

The stricter path has costs: unparsable non-GSO traffic pays host CPU for software completion, and odd GSO frames may be dropped. A per-network-namespace sysctl, net.core.virtio_net_hdr_validate (default on), restores the old trust-the-header behavior for deployments that do no protocol processing on these packets. Tun also counts software completions via ethtool so operators can spot workloads that depend on uncommon metadata.

Tsirkin said Yibelo's report drew wide attention and argued for closing the whole class quickly. Arges retested the series against his original cases. The work is aimed at the main networking tree and is described as too large for stable backports.