From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 093BC8017D for ; Mon, 9 Nov 2026 18:06:02 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9I4fCc002319; Mon, 9 Nov 2026 21:04:42 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9I4fCc002319 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="xwSYkA3c" Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9I4dRQ002315 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 9 Nov 2026 21:04:39 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9I4dRQ002315 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-48e29c25101so573213f8f.3 for ; Mon, 09 Nov 2026 10:04:39 -0800 (PST) X-Gm-Message-State: APuU4Z8Ihs8cSyuw+AA/ko6Nm48SQqyVe926LlnIkoCeoOdu+aJnwUEl Z0QCJMrt7brbypppSMCs132ZD4z3/6cZO1YBKa/aeT40ZHitXLehQq063i7chGCQglkkvPRwKp/ A0Bz9mw5WGpfUrpw7EVgEZt44d7OXlYPykN7N8iPmPS6YaNZgXwdUVw== X-Gm-Gg: AYBFou3YX4T72NfUQuNnQMr4AzxL/Jb3OW2Exjd2aCdsmPMpfgeF35QnZ9huOoNH03a vqbjAIgw7BUhUsrh0HhlP2XGamM4/R2nHg2UIJwCsbGPyrmKUHrQV8IlkdgiJpGorrBez5lGxSK 5xhKcptDXUwnNZXZzyd882Ll0ZbX5hZEr/88Qm5LiF4boK6MIi1m97u93uSjO8SslqzUArr6HfC S8VG+2yEWho812Qy8eMAag5n7rf3uj3C78P9U4oxZjMWz4e3gyhwW6UxCgHtarZB320AY2MEKE1 jmyFgcdRMIqdkePdKMul/+bO4taQF1conA8Yfj6w9DXXnoWKrO35BS4w0CGSl32WKVpYpBuF2YH LzSuS8vd44EfVeUOq X-Received: by 2002:a05:6000:460a:b0:48d:b75d:30f6 with SMTP id ffacd0b85a97d-498302fbb2dmr342799f8f.35.1794247479448; Mon, 09 Nov 2026 10:04:39 -0800 (PST) X-Received: by 2002:a05:6000:460a:b0:48d:b75d:30f6 with SMTP id ffacd0b85a97d-498302fbb2dmr342744f8f.35.1794247478857; Mon, 09 Nov 2026 10:04:38 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1794247478; cv=none; d=google.com; s=arc-20260327; b=piyVDgxiQI9avIPQ3eoYf+8I0RMNpl1IfNgFcolJP0Sufv0re9KgK4gPv+GI1fptmc R+RSje12FR3dxGa3Cti7deEaMQjV/1FNuGXxVoIUz6d6QOP1/pLKH79XTtemkOab1Fmd fUadl7dB612jGexLXm376HlVOr9U86mHX7GT4e13jjSZwj9xjqT11fz5SEFM7/mjdlXb j/XIu/JrAHs5JPlpG5SBTtVYILCvXAvK0HtWomwSX3iieaXwTb1OXHhY7KtxNCLOWpB6 xy3XI7E/iMxsuqFf9FERhKIJTvhQX+g1Rx55uBrWmw7CYYJeW/cEvCemNOZ8ris0x3J4 MMxw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:dkim-signature; bh=u5p0IH+t3P+raQcU+GpGnhaHz9SMjBr+PjTNYCAK0mU=; fh=26FXTO6eY/S3gvyMXNKNKTFHQ0lD1bPkQ8wRpe0tMZI=; b=kxmuP7vJcCpSi6ud6mSBIfPgu/l1pKf6jhOgmyAbAC3rogyz1tl2fFPT1InP3tWdH1 aaCdZwK4VB2UKYLsEb7/Ql+GSqGER/6e1kd0dzxfI7JAz4Plu80NZiPD7Ztrp9s1kd/q D8/nHeh6KRWy4+RSU3e+SGbAnpvVLp+NZG6UIvEgFb04mX0CXgjMQVLY1ONyFho8nWf2 r1jgvdUURzC8r1dhgffUOZv7Qos5mlsF7yXCXE6GXnvBBMSv9yjZ0eputBEYkEgHRTBd To6GOpoDvbY/bKiLzu0Bm+0l8h2TuIBGJUCY1FiyOS0QODbNq4icJjJuyv7pn5qICkyZ e2Lg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=xwSYkA3c; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-498320a576fsi349101f8f.40.2026.11.09.10.04.38 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Nov 2026 10:04:38 -0800 (PST) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=xwSYkA3c; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=u5p0IH+t3P+raQcU+GpGnhaHz9SMjBr+PjTNYCAK0mU=; b=xwSYkA3cgm9QGAF7uWo bE/ssw85i9oWmnqJCIJPf5eUfqaFUSqdrfmW2tu79qmZW/vp/ACh+wshdxUbZImD4sUX6RmAWcapt mF+VRNJ5FiCxf2Mjg4kOf2qVz1nfvFoYFI/GkCFpuyKBiRNfR/rCr7k0Hi+1zkJ+PAFgjWiHXHqwQ qhLtHtwHU/9VnuJhrGVsYdR9Rnc3fS6XprH+3X6hdtmTYTg6YRuUa1GhA7FXvEcDTYTgaaJhLrAl4 1/51JNglARgf5xlXt7Y2aCPe373ZHzdWQLmE+q64Q3/t8HjsC1O9zAE1H5kJtogN/knWqlrV4vlET QFGTA5ipQKomMxw==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xQTfN-00AXZI-2J; Mon, 09 Nov 2026 19:04:29 +0100 From: Konstantin Khorenko Date: Mon, 09 Nov 2026 19:04:34 +0100 MIME-Version: 1.0 Message-Id: <20261109-b4-prep-khorenko-vstor-154184-ipv4-checksum_start-v1-1-29d1d4321a63@virtuozzo.com> X-B4-Tracking: v=1; b=H4sIADEL8moC/yWNUQ6CMBAFr0L2200oaVG8ijGGlkUqkTa7pTES7 m7Vz3nJm9lAiD0JnKsNmLIXH5YC6lCBm/rlTuiHwtDUTatU3aHVGJkizlNgWuaAWVJgVEark0Y fs0Y3kZtlfd4k9ZywHVtrTKfMYBwUb7mP/vVrXiC/j3D9j7LaB7n0rcG+fwAKqwWXmgAAAA== X-Change-ID: 20261109-b4-prep-khorenko-vstor-154184-ipv4-checksum_start-6f6b55915d5c To: Konstantin Khorenko X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=6929; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=/7N/eSIYdLptLEKkQ1Q+Ug7/n8/aAKuGHgydgPnZRMg=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBq8gs1PEu5SbI5SSFBy+Zqr6XOh+2LWTzvhj/oV d4Jx9kEoviJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCavILNQAKCRBRlgpH+WFc KkqwD/0f4mKkEIFSYLtZCysU3Dwlely5R6LyCElpjWARdAqUTpErULxHOzlRyro8RxVZ2+IrTlz TJFp/oj27ZJP2uwBIAlWfbwtzTewoeEX3qMFwbd1ikuYilCSS4XIpSkFJ/9KQAdtu1MiBG6HFnN I/RuDtRdf5mC7ykOsV5I3IWzRJre+xpaXmFNYwbzri2FHFwVy83iX7IT9Mqu3zZ89FR5AMVT+H2 2CahBu+kjPySP5+d2GlnD8UdY8ZsnIqaDynBJXHi1oZJnLFWpOedscN3zzw97a2bhvkJTH90hlP 7EMNYLyQMu/QfEpST3JE5vCmNOTV/nN/acmqLV8IkRe6XibMVeudkfCtM0dFs6vMYyWqEPsB7Zc CRZxS6lk/c38CfyTozokFnhl/pBlxsZLOLj1/2dXi9KWzbne5bbgwE7uHn0lGoYYjbb7b8UyYzZ UYaXJFadgAd1HG5rHnn28gHpNK8PiqnyOR3WqTLrlPlZ7bNE5lSy+jTm5rgnVaThbjf+r5jMWq9 w8xgiMgVYVQKpVBjjCXNvFF2V56gT+tWSIdEh/abyHc6tBMkM8UHJlS5pmCOHFM2Tc1Oo7ehAIq bExFnlbvJCcee8nTl6BIhyB1qpt/E1zfuezte7gwVC+55F0+mHoY+nXxn5RTI/qTOqL7TEMTubG rXpK/pNrlffHY7w== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH vz7] ms/ipv4: validate checksum_start before completing checksum X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: "Michael S. Tsirkin" If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. Cc: stable@vger.kernel.org Fixes: f43798c27684 ("tun: Allow GSO using virtio_net_hdr") Fixes: bfd5f4a3d605 ("packet: Add GSO/csum offload support.") Reported-by: Paulos Yibelo Closes: https://lore.kernel.org/netdev/20260922030310.8684-2-habte.yibelo@gmail.com/ Signed-off-by: Michael S. Tsirkin Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/0a012b4923e189c4c593ef4f471e5ff0edbe9030.1791412497.git.mst@redhat.com Signed-off-by: Jakub Kicinski (cherry picked from commit 6785011f8b16abf40b1e9d8b2e332232b3e68822) Backport notes: - drop the net/bridge/netfilter/nf_conntrack_bridge.c hunk; - add nf_queue_checksum_help() to nfnetlink_queue_core.c with the IPv4 check only, and call it from nfqnl_build_packet_message(). nf_conntrack_bridge.c came with ms commit 3c171f496ef5 ("netfilter: bridge: add connection tracking system") in v5.3 and does not exist here. nf_queue_checksum_help() came with ms commit 26a77d02891a ("netfilter: nfnetlink_queue: unbreak SCTP traffic"), so here nfqnl_build_packet_message() still calls skb_checksum_help() directly. The helper is added without the SCTP branch of that commit. The four guarded sites are all skb_checksum_help() callers under net/ipv4, net/netfilter and net/xfrm in this tree. RHEL7 kernel-3.10.0-1160.169.1.el7 carries the same change. CVE-2026-99999 https://virtuozzo.atlassian.net/browse/VSTOR-154184 Signed-off-by: Konstantin Khorenko --- CVE-2026-99999 (PwnEscape) fix for the vz7 kernel. https://virtuozzo.atlassian.net/browse/VSTOR-154184 Assisted-by: LLM --- include/net/ip.h | 7 +++++++ net/ipv4/ip_output.c | 10 +++++++--- net/netfilter/nfnetlink_queue_core.c | 13 ++++++++++++- net/netfilter/xt_CHECKSUM.c | 6 +++++- net/xfrm/xfrm_output.c | 16 +++++++++++----- 5 files changed, 42 insertions(+), 10 deletions(-) diff --git a/include/net/ip.h b/include/net/ip.h index b321d2a5fc3df..138e1c2152a64 100644 --- a/include/net/ip.h +++ b/include/net/ip.h @@ -57,6 +57,13 @@ static inline unsigned int ip_hdrlen(const struct sk_buff *skb) return ip_hdr(skb)->ihl * 4; } +static inline int ip_check_csum_start(const struct sk_buff *skb) +{ + if (unlikely(skb->csum_start < skb->network_header + ip_hdrlen(skb))) + return -EINVAL; + return 0; +} + struct ipcm_cookie { __be32 addr; int oif; diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index f7195e5f72e5d..7d66717027b4a 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -539,9 +539,13 @@ int ip_do_fragment(struct sock *sk, struct sk_buff *skb, dev = rt->dst.dev; /* for offloaded checksums cleanup checksum before fragmentation */ - if (skb->ip_summed == CHECKSUM_PARTIAL && - (err = skb_checksum_help(skb))) - goto fail; + if (skb->ip_summed == CHECKSUM_PARTIAL) { + err = ip_check_csum_start(skb); + if (!err) + err = skb_checksum_help(skb); + if (err) + goto fail; + } /* * Point into the IP datagram header. diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c index ff2d4b31b353e..591c3f3b9bc21 100644 --- a/net/netfilter/nfnetlink_queue_core.c +++ b/net/netfilter/nfnetlink_queue_core.c @@ -29,6 +29,7 @@ #include #include #include +#include #include #include #include @@ -245,6 +246,16 @@ nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet, return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0; } +static int nf_queue_checksum_help(struct sk_buff *entskb) +{ + if (entskb->protocol == htons(ETH_P_IP)) { + if (!pskb_network_may_pull(entskb, sizeof(struct iphdr)) || + ip_check_csum_start(entskb)) + return -EINVAL; + } + return skb_checksum_help(entskb); +} + static struct sk_buff * nfqnl_build_packet_message(struct nfqnl_instance *queue, struct nf_queue_entry *entry, @@ -297,7 +308,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue, case NFQNL_COPY_PACKET: if (!(queue->flags & NFQA_CFG_F_GSO) && entskb->ip_summed == CHECKSUM_PARTIAL && - skb_checksum_help(entskb)) + nf_queue_checksum_help(entskb)) return NULL; data_len = ACCESS_ONCE(queue->copy_range); diff --git a/net/netfilter/xt_CHECKSUM.c b/net/netfilter/xt_CHECKSUM.c index db286fc0bc32a..1d4efe9c59fcb 100644 --- a/net/netfilter/xt_CHECKSUM.c +++ b/net/netfilter/xt_CHECKSUM.c @@ -18,6 +18,7 @@ #include #include +#include MODULE_LICENSE("GPL"); MODULE_AUTHOR("Michael S. Tsirkin "); @@ -28,8 +29,11 @@ MODULE_ALIAS("ip6t_CHECKSUM"); static unsigned int checksum_tg(struct sk_buff *skb, const struct xt_action_param *par) { - if (skb->ip_summed == CHECKSUM_PARTIAL && !skb_is_gso(skb)) + if (skb->ip_summed == CHECKSUM_PARTIAL && !skb_is_gso(skb)) { + if (xt_family(par) == NFPROTO_IPV4 && ip_check_csum_start(skb)) + return NF_DROP; skb_checksum_help(skb); + } return XT_CONTINUE; } diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c index 65a0e1a9ac985..a1d6c922f43e0 100644 --- a/net/xfrm/xfrm_output.c +++ b/net/xfrm/xfrm_output.c @@ -197,15 +197,21 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) return xfrm_output_gso(sk, skb); if (skb->ip_summed == CHECKSUM_PARTIAL) { - err = skb_checksum_help(skb); - if (err) { - XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); - kfree_skb(skb); - return err; + if (skb->protocol == htons(ETH_P_IP)) { + err = ip_check_csum_start(skb); + if (err) + goto error; } + err = skb_checksum_help(skb); + if (err) + goto error; } return xfrm_output2(sk, skb); +error: + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); + kfree_skb(skb); + return err; } int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb) --- base-commit: 78c10c447efc7633a8e4260fe7dc33e1cb4bb4d2 change-id: 20261109-b4-prep-khorenko-vstor-154184-ipv4-checksum_start-6f6b55915d5c Best regards, -- Konstantin Khorenko, Virtuozzo Linux Kernel Team _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel