Linux tightens virtio-net checksum handling against untrusted devices
Ingress path now validates partial checksum metadata so guest or hardware edits cannot leave the stack with two views of the same packet.
Michael S. Tsirkin has posted a net-next series that hardens how Linux treats partial checksum metadata on packets that arrive with a virtio net header, closing a class of inconsistencies first reported by Paulos Yibelo.
The problem is trust. A virtio net header can mark a packet CHECKSUM_PARTIAL and name any start and offset inside the frame. If an untrusted device or guest later rewrites bytes outside that claimed checksum field, different parts of the networking stack can observe the packet before and after the edit and reach different conclusions. Earlier work tried to catch the worst known cases at completion time. Tsirkin’s series instead treats the metadata as untrusted at ingress.
On receive, the kernel now keeps partial checksum state only when the claimed start and offset line up with a real TCP or UDP header it can parse, including common cases such as VLANs, IPv4 options, IPv6 extension headers, and inner headers of UDP tunnels. Other non-GSO packets have their checksum completed immediately, before protocol processing runs, so later stages always see a consistent frame. Unparseable GSO packets are dropped rather than segmented under bogus offload claims. Packets that never asked for partial checksum offload are unchanged.
That is stricter than the previous behavior, so non-GSO frames the stack cannot parse pay a software checksum cost, and odd GSO frames may disappear. A per-network-namespace sysctl, off by default for the new checks only if an admin opts out, restores the old path for deployments that do no protocol processing on these packets and need the escape hatch. The work also fixes related header-conversion error handling in the User Mode Linux vector transport, which had been ignoring failed virtio header conversion and letting unvalidated packets continue.
The series effectively narrows virtio net header checksum offload to known-good cases, reversing the more permissive model introduced when tun gained GSO support via that header format. Chris Arges at Cloudflare also reported impact and tested the approach.