From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 5CB368017D for ; Fri, 16 Oct 2026 21:09:59 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69GL8Yf9021095; Sat, 17 Oct 2026 00:08:35 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69GL8Yf9021095 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="PMhxYWz0" Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69GL8WmA021089 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Sat, 17 Oct 2026 00:08:32 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69GL8WmA021089 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-4a01d1fb07bso3092435e9.2 for ; Fri, 16 Oct 2026 14:08:32 -0700 (PDT) X-Gm-Message-State: AFq9FYKvAM00vHI3X86VOisYV+s1Z3qWjDgX9tyHHtVp0QZUkX0I7/OX 4TMyhxSbOjDHSN4hRAAIZbCUBlHoYjUmaZGdM2TO5LWks3UjS0T6xAE8x+zeOSoxr0w63wK3fNx K7fXrU6aagtl2AfWri5S95R6hL5UMStFqBIuNzBbBtQc5vZMlGA/LsQ== X-Gm-Gg: AYBFou1HqpENDVY/r2HZ5V5xs0msxyGriGmlek0bOH79q1gRYjthbN3UyZRO8gzMAH8 ZYB8WC8hzKkARcRWPEWLPLkYgis/vUKBS/kqM/LYan17nLrqAVOaqwjQ9qRt2SISgxnmka98lSN Aezycgjv1LJBWdDuezpmtZ6sa+QesqOxDiqQQFY1/UoqL1HzzZIzOkeb/4ooN6EZS+w+fMK0g8m OMB3dyoDvW5XPpivsGsl+8SMFy68VDzNZhAerzBClBFmKHry5ydx1/pcYS4HcFdP+Z+Dw313lvX qVxnKOzNlZ1Oc9w5cxYsanUSTh3PHjnhu5p4aGe4Z6aRrNH95c4C1bSl/SWBj5JjRnuPRf8Qv3T NVNPYpzkQ0EtKkjD/ X-Received: by 2002:a05:600c:a05:b0:4a1:813f:2a57 with SMTP id 5b1f17b1804b1-4a1d7608058mr21543845e9.13.1792184912222; Fri, 16 Oct 2026 14:08:32 -0700 (PDT) X-Received: by 2002:a05:600c:a05:b0:4a1:813f:2a57 with SMTP id 5b1f17b1804b1-4a1d7608058mr21543355e9.13.1792184911646; Fri, 16 Oct 2026 14:08:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1792184911; cv=none; d=google.com; s=arc-20260327; b=R5jvQZHludErJnoOsKmiYFkZmD/TMJCyjHtCP3hemGvNusnD7LPWeBbFSKrx5CiPLv KBwvo2uzwjz0i9LrvOGtU4eHNKLaEgrd+JHCBhTkMEvXUed5rI5x9hS4ihPp+8fAklOX 6QsUvLXKelswo35+gIICrpkr6nYjT0e/FoXEKbIcPjnsxIlcOoeriylRRzZxCzDxI7/S d2r8vsWd3SS2oQLRlXj4TLNqk1Y2b9tIzFRiGlcsiOnAx6SOcIGhasmIu2y6C90fsqej DMByP/tcznziVLIXC8thzRuOOO3gKuUck3YLUSqanDdYJonGeahNNyG6v4YM2f7SxCLV U71Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=to:message-id:content-transfer-encoding:mime-version:subject:date :from:dkim-signature; bh=nawaC0K/Nn9aTNkokYl4gyArxHGrhxwu5GFo2JcLDwM=; fh=u94vpSnbACPnIkIPa1XdGqhjZt/kxdbqUA9AiFps/bg=; b=YnC898A96x0x1lOo9C8mqoDbshO7jf5JRQGq+6PSic97z35huWqcP7aiPELs7aHU4H yx7ugZBHwa5G5VoV1GiWMneW+zd33wHR67XI+E2kpuxqdqUtwuW+Fvwq9kuYpas0gkaV oG/ZdtAFgHFEOZhnMXJNoRklXhRB4ZB1UdHJQUjbnL9GGLhxeWh5D1vz9d76m/q95ZIF kzZe4R1XEFKokDZynnYgUBZMjQJ8Sle5gly6aWTJnP7lOSCoucbwg4oZkNsbz/0g1JA8 YqhVjDGzAkaNfelhF1d+Zxep9rg/kbwWUkQnJJ+zFPFZpl8kccQm42OnQjKyKjJFlP9M Je2w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=PMhxYWz0; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48dfd528476si9719495f8f.404.2026.10.16.14.08.31 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Oct 2026 14:08:31 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=PMhxYWz0; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=nawaC0K/Nn9aTNkokYl4gyArxHGrhxwu5GFo2JcLDwM=; b=PMhxYWz06RpuzuLmc0H k1vh0hYUphcYD38Uz/sAWrz0SLSpk16h828mEsVCRX3cDHq31DiCN2EMkR0r2z09HBr+3IKkCUdBy SuFINFZQPO/GabTung8DjMe+57G3cRRYX9SjnV02nlTW59fuLC3JmtCau6nUxAKRCeno0pPgOCP9l 0XTbNQ0Imxq2ZO28N3GqTvOQj51kknD8oZrAAgDGCiyVn6WBT+WJbgZZScLxr5Zk5mgP9vKFOOHNi 4AH+pRg607g+VC5afKQ/6wjK9K9YD7K8xawmhYK/y2ptgl+qGloiZilPBsKGwd5JN40L3PnXuULbN MEMkNBcTzFEu4vQ==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xHp6k-00G7F9-27; Fri, 16 Oct 2026 23:08:26 +0200 From: Konstantin Khorenko Date: Fri, 16 Oct 2026 23:08:22 +0200 MIME-Version: 1.0 Message-Id: <20261016-cve-v1-1-d244f4c79d4c@virtuozzo.com> X-B4-Tracking: v=1; b=H4sIAEWS0moC/yWMwQ6CMBAFf4W8szXdoqT6K4YDbFdZD0haJCSEf 6fAcTKTWZAkqiQ8iwVRJk366zPQpQB3Tf8RoyEznHUVWaoMT2JCeMiNS7Le35HLIcpb5+PyQsd q/JVQnyL926/wuD+wrhuyEWPucAAAAA== X-Change-ID: 20261016-cve-dd9e4c310885 To: devel@openvz.org, Konstantin Khorenko X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=6403; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=rUvnVlIBvRZiO5i6L2Hs3/sRzLWr2ueawTVCXAb8H8c=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBq0pJNmiATBpqjgA+t0CZ4Jx6Dj1zHOmlzveNOK Uxo7QzYuG+JAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCatKSTQAKCRBRlgpH+WFc KsRkEACqltZGb0BlV7gUaPIKD5yiIz7thrWjhKy5p1YPfR+19DqN7mmGM1LJYwmJ4Xu0g+Ch+XG CkQn6XrSQ4xZv5hpbiwc64mXb/2mfRhC7zkMIgDE3fBqTgROqvtQn11JbjNMDAzf89Pcti6nSAQ yWGkuJgqcyZcu9jT99KWXVAUFKytS7I5csEqEe8r02U//E4ktQGsTOXxknd+0wVBCiriyqd/sH5 tfMdSbqdHvkieuh5ckKcVlpvAdPd797SfeZnAYrKj2C4FqNNEHkb6jMnhkXlTqu6YrlKB9R73oj qQb0a36BJeGgmifqNBjDHfIzLAgMfdTqoP8epPuJdgvAdIIgACkWSYkICqU9HUJM/DEbmIeyO/O R0B6YoTe3jParsN2kEA467UUbmwxU2qnj9Rb/efa8u0MLCysOAo3/XbVEp8qgiUnazXPdrmrgMH 5jYZg1uesR9J9Lb+WTdRDix05r++ldrK94xvwaJCsGLvTpRYumzh6HHw9MzQBOqo37LGQ7gediL TC0I5bCkt5ixylomhjTG6lWSQ0+C9VZh/tFdde9B5s7XIgVw+SKyjbYZbehG8fWtnfWQ0PFSaYa FeHvGSq0/e29jTghIWKf+npDtrEDmTztAMo/NzPuuN3AYFx0oqwsj3myWfcunvUCndq/lv/w4re aLolOnKc07xYnzw== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Subject: [Devel] [PATCH hci-8.1] ms/ipv4: validate checksum_start before completing checksum X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: "Michael S. Tsirkin" commit 6785011f8b16abf40b1e9d8b2e332232b3e68822 upstream. If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. Cc: stable@vger.kernel.org Fixes: f43798c27684 ("tun: Allow GSO using virtio_net_hdr") Fixes: bfd5f4a3d605 ("packet: Add GSO/csum offload support.") Reported-by: Paulos Yibelo Closes: https://lore.kernel.org/netdev/20260922030310.8684-2-habte.yibelo@gmail.com/ Signed-off-by: Michael S. Tsirkin Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/0a012b4923e189c4c593ef4f471e5ff0edbe9030.1791412497.git.mst@redhat.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 32a8b0adaa18e52aaa0b246b5ffe683075354dbb) The patch has been backported from the stable linux-6.12.y branch. CVE-2026-99999 https://virtuozzo.atlassian.net/browse/VSTOR-150637 Feature: fix ms/net Assisted-by: LLM Signed-off-by: Konstantin Khorenko --- include/net/ip.h | 7 +++++++ net/bridge/netfilter/nf_conntrack_bridge.c | 10 +++++++--- net/ipv4/ip_output.c | 10 +++++++--- net/netfilter/nfnetlink_queue.c | 7 +++++++ net/netfilter/xt_CHECKSUM.c | 6 +++++- net/xfrm/xfrm_output.c | 16 +++++++++++----- 6 files changed, 44 insertions(+), 12 deletions(-) diff --git a/include/net/ip.h b/include/net/ip.h index 7e7db511c9630..01c7ed96585ee 100644 --- a/include/net/ip.h +++ b/include/net/ip.h @@ -74,6 +74,13 @@ static inline unsigned int ip_hdrlen(const struct sk_buff *skb) return ip_hdr(skb)->ihl * 4; } +static inline int ip_check_csum_start(const struct sk_buff *skb) +{ + if (unlikely(skb->csum_start < skb->network_header + ip_hdrlen(skb))) + return -EINVAL; + return 0; +} + struct ipcm_cookie { struct sockcm_cookie sockc; __be32 addr; diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c index 6482de4d87509..10127b7588efa 100644 --- a/net/bridge/netfilter/nf_conntrack_bridge.c +++ b/net/bridge/netfilter/nf_conntrack_bridge.c @@ -40,9 +40,13 @@ static int nf_br_ip_fragment(struct net *net, struct sock *sk, int err = 0; /* for offloaded checksums cleanup checksum before fragmentation */ - if (skb->ip_summed == CHECKSUM_PARTIAL && - (err = skb_checksum_help(skb))) - goto blackhole; + if (skb->ip_summed == CHECKSUM_PARTIAL) { + err = ip_check_csum_start(skb); + if (!err) + err = skb_checksum_help(skb); + if (err) + goto blackhole; + } iph = ip_hdr(skb); diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index f7f8048ba122a..7a9e11ab4ad96 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -779,9 +779,13 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, int err = 0; /* for offloaded checksums cleanup checksum before fragmentation */ - if (skb->ip_summed == CHECKSUM_PARTIAL && - (err = skb_checksum_help(skb))) - goto fail; + if (skb->ip_summed == CHECKSUM_PARTIAL) { + err = ip_check_csum_start(skb); + if (!err) + err = skb_checksum_help(skb); + if (err) + goto fail; + } /* * Point into the IP datagram header. diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c index b6ad12029fa9d..c3453d73564af 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -33,6 +33,7 @@ #include #include #include +#include #include #include #include @@ -607,6 +608,12 @@ static int nfqnl_put_bridge(struct nf_queue_entry *entry, struct sk_buff *skb) static int nf_queue_checksum_help(struct sk_buff *entskb) { + if (entskb->protocol == htons(ETH_P_IP)) { + if (!pskb_network_may_pull(entskb, sizeof(struct iphdr)) || + ip_check_csum_start(entskb)) + return -EINVAL; + } + if (skb_csum_is_sctp(entskb)) return skb_crc32c_csum_help(entskb); diff --git a/net/netfilter/xt_CHECKSUM.c b/net/netfilter/xt_CHECKSUM.c index 9d99f5a3d1764..1fb0f8118404d 100644 --- a/net/netfilter/xt_CHECKSUM.c +++ b/net/netfilter/xt_CHECKSUM.c @@ -15,6 +15,7 @@ #include #include +#include MODULE_LICENSE("GPL"); MODULE_AUTHOR("Michael S. Tsirkin "); @@ -25,8 +26,11 @@ MODULE_ALIAS("ip6t_CHECKSUM"); static unsigned int checksum_tg(struct sk_buff *skb, const struct xt_action_param *par) { - if (skb->ip_summed == CHECKSUM_PARTIAL && !skb_is_gso(skb)) + if (skb->ip_summed == CHECKSUM_PARTIAL && !skb_is_gso(skb)) { + if (xt_family(par) == NFPROTO_IPV4 && ip_check_csum_start(skb)) + return NF_DROP; skb_checksum_help(skb); + } return XT_CONTINUE; } diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index 3fc5eb3487135..ef72183dbba94 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -808,16 +808,22 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) } if (skb->ip_summed == CHECKSUM_PARTIAL) { - err = skb_checksum_help(skb); - if (err) { - XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); - kfree_skb(skb); - return err; + if (skb->protocol == htons(ETH_P_IP)) { + err = ip_check_csum_start(skb); + if (err) + goto error; } + err = skb_checksum_help(skb); + if (err) + goto error; } out: return xfrm_output2(net, sk, skb); +error: + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); + kfree_skb(skb); + return err; } EXPORT_SYMBOL_GPL(xfrm_output); --- base-commit: defa968cbe8c38f1ff0231042dee07f00d27b2c9 change-id: 20261016-cve-dd9e4c310885 Best regards, -- Konstantin Khorenko _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel