more virtio-net csum hardening

The vector receive path over-allocates the skb and only trims it to the received length after the transport header is verified.

A follow up patch will complete the packet checksum in software within virtio_net_hdr_to_skb so we need the packet trimmed (otherwise the checksum would be computed incorrectly over the unreceived tail of the buffer).

Trim first, so the import sees the packet as it was received.

Signed-off-by Michael S. Tsirkin <[email protected]>

As reported first by Paulos Yibelo <[email protected]> (after which others, credited below, found more ways the bug can affect users) a virtio net header can place CHECKSUM_PARTIAL at any in-packet offset. If that state is retained, later checksum completion can modify the packet after protocol processing has made decisions from it.

Let's fix that: let's validate csum_start and csum_offset and only keep CHECKSUM_PARTIAL when csum_start and csum_offset match a parsed TCP or UDP header, while handling VLAN headers, IPv4 options and IPv6 extension headers. Complete other non-GSO checksums immediately, before any protocol processing runs.

We can't easily "complete the checksum" for GSO we don't recognize - GSO assumes knowledge of the protocol. We could segment ignoring the checksum then do whatever csum_start and csum_offset say, but that seems like an overkill for something that shouldn't happen.

There's some risk here:
- non-gso packets which can't be parsed get checksum calculated in software, adding performance overhead
- gso packets which can't be parsed get dropped

To mitigate the risks, the following patch will add a sysctl knob to bypass the resolution. This is reasonable if the setup is such that there is no protocol processing at all.

UDP tunnel headers get the same handling on the inner header.

Packets without VIRTIO_NET_HDR_F_NEEDS_CSUM are unaffected.

Reported-by Paulos Yibelo <[email protected]>

Reported-by Chris Arges <[email protected]>

Tested-by Chris Arges <[email protected]>

Fixes f43798c27684 ("tun: Allow GSO using virtio_net_hdr")

Suggested-by Willem de Bruijn <[email protected]>

Signed-off-by Michael S. Tsirkin <[email protected]>

---
 drivers/net/tap.c          |   8 +-
 drivers/net/tun.c          |   8 +-
 drivers/net/virtio_net.c   |   3 +-
 include/linux/virtio_net.h | 276 ++++++++++++++++++++++++++++++++++++-
 4 files changed, 281 insertions(+), 14 deletions(-)

drivers/net/tap.c +2 -2

index d7520622e809..f2a9bb443980 100644
@@ -653,9 +653,9 @@ static ssize_t tap_get_user(struct tap_queue *q, void *msg_control,
 			rcu_read_unlock();
 			drop_reason = SKB_DROP_REASON_DEV_HDR;
 			goto err_kfree;
-		}
-		if (err > 0)
+		} else if (err > 0) {
 			atomic64_inc(&tap->rx_csum_sw);
+		}
 	}
 
 	skb_probe_transport_header(skb);

drivers/net/tap.c +0 -0

 	}
 
 	skb_probe_transport_header(skb);

The ingress validation as implemented by the previous patch is stricter than what it replaced: GSO
packets whose checksum metadata matches no transport header are dropped, and non-GSO ones get their checksum completed in place. Such packets used to pass with the metadata unvalidated, and with no overhead.

I judge that this should not affect any deployments, but there is still some risk that it does. In case a deployment depends on them anyway, provide a per-netns switch to get the old behavior back:

echo 0 > /proc/sys/net/core/virtio_net_hdr_validate

The default is validating.

Reviewed-by Björn Töpel <[email protected]>

Signed-off-by Michael S. Tsirkin <[email protected]>

Multiple places in the net stack open-code the same minimal IPv4 header
validation: pull the fixed header, check version 4 and IHL >= 5 (where 5 is the fixed header size in 32-bit units) - and locate the transport header at IHL * 4 past the network header.

Add a helper for doing that: it returns the validated header and the transport header offset, or NULL if truncated or malformed.

As noted by Phil Sutter, there are more places that could use this helper, e.g. ip_mc_check_iphdr(). They will be converted in a follow-up patch.

Signed-off-by Michael S. Tsirkin <[email protected]>

Reviewed-by Björn Töpel <[email protected]>

Reviewed-by Phil Sutter <[email protected]>

---
 include/linux/ip.h                  | 30 +++++++++++++++++++++++++++++
 include/linux/virtio_net.h          | 28 +--------------------------
 net/bridge/br_netfilter_hooks.c     | 15 +++++----------
 net/ipv4/ip_input.c                 | 13 +++++--------
 net/ipv4/netfilter/nf_reject_ipv4.c | 13 +++++--------
 5 files changed, 46 insertions(+), 53 deletions(-)

include/linux/ip.h +0 -0

index d11c25f5030a..aba37cd60212 100644

include/linux/ip.h +27 -0

+ * @skb: buffer to parse
+ * @nhoff: offset of the IPv4 header within the linear data
+ * @thoff: returns the transport header offset
+ *
+ * Only the fixed header is guaranteed linear on return: callers
+ * that need the options or the transport header must pull
+ * further.
+ *
+ * Return: the validated IPv4 header, or NULL if truncated or
+ * malformed.
+ */
+static inline struct iphdr *ip4_parse(struct sk_buff *skb,
+				      unsigned int nhoff,
+				      unsigned int *thoff)
+{
+	struct iphdr *iph;
+
+	if (!pskb_may_pull(skb, nhoff + sizeof(struct iphdr)))
+		return NULL;
+
+	iph = (struct iphdr *)(skb->data + nhoff);
+	if (iph->version != 4 || iph->ihl < sizeof(struct iphdr) / sizeof(u32))
+		return NULL;
+
+	*thoff = nhoff + iph->ihl * sizeof(u32);
+	return iph;
+}
 #endif	/* _LINUX_IP_H */

include/linux/virtio_net.h +1 -27

index b3bbecbd023c..724ab8659501 100644
@@ -53,32 +53,6 @@ static inline int virtio_net_hdr_set_proto(struct sk_buff *skb,
 	return 0;
 }
 
-/* TODO: nothing virtio specific here, move to ip.h */
-
-/*
- * Pull and minimally validate the IPv4 header at @nhoff.
- * Returns the header and stores the transport header offset in
- * @thoff, or NULL if truncated or malformed.  Only the fixed header
- * is guaranteed linear; callers that need the options or the
- * transport header must pull further.
- */
-static inline struct iphdr *virtio_net_ip4_parse(struct sk_buff *skb,
-						  unsigned int nhoff,
-						  unsigned int *thoff)
-{
-	struct iphdr *iph;
-
-	if (!pskb_may_pull(skb, nhoff + sizeof(struct iphdr)))
-		return NULL;
-
-	iph = (struct iphdr *)(skb->data + nhoff);
-	if (iph->version != 4 ||
-	    iph->ihl < sizeof(struct iphdr) / sizeof(u32))
-		return NULL;
-
-	*thoff = nhoff + iph->ihl * sizeof(u32);
-	return iph;
-}
 /* Defined in net/core/dev.c, enabled while any network namespace
  * has net.core.virtio_net_hdr_validate set to 0.
  */

@@ -157,7 +131,7 @@ virtio_net_l4_start(struct sk_buff *skb, unsigned int nhoff, __be16 proto,
 		    unsigned int *thoff, int *ip_proto)
 {
 	if (proto == htons(ETH_P_IP)) {
-		const struct iphdr *iph = virtio_net_ip4_parse(skb, nhoff, thoff);
+		const struct iphdr *iph = ip4_parse(skb, nhoff, thoff);
 
 		if (!iph || ip_is_fragment(iph))
 			return false;

net/bridge/br_netfilter_hooks.c +5 -10

index 0a394e5f4391..e89da0e41542 100644
@@ -206,18 +206,13 @@ static inline void nf_bridge_pull_encap_header_rcsum(struct sk_buff *skb)
 static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
 {
 	const struct iphdr *iph;
-	u32 len;
+	u32 len, thoff;
 
-	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+	iph = ip4_parse(skb, 0, &thoff);
+	if (!iph)
 		goto inhdr_error;
 
-	iph = ip_hdr(skb);
-
-	/* Basic sanity checks */
-	if (iph->ihl < 5 || iph->version != 4)
-		goto inhdr_error;
-
-	if (!pskb_may_pull(skb, iph->ihl*4))
+	if (!pskb_may_pull(skb, thoff))
 		goto inhdr_error;
 
 	iph = ip_hdr(skb);

@@ -228,7 +223,7 @@ static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
 	if (skb->len < len) {
 		__IP_INC_STATS(net, IPSTATS_MIB_INTRUNCATEDPKTS);
 		goto drop;
-	} else if (len < (iph->ihl*4))
+	} else if (len < thoff)
 		goto inhdr_error;
 
 	if (pskb_trim_rcsum(skb, len)) {

net/ipv4/ip_input.c +5 -8

index 9860178752b8..5adf01763e85 100644
@@ -500,7 +500,7 @@ static struct sk_buff *ip_rcv_core(struct sk_buff *skb, struct net *net)
 {
 	const struct iphdr *iph;
 	int drop_reason;
-	u32 len;
+	u32 len, thoff;
 
 	/* When the interface is in promisc. mode, drop all the crap
 	 * that it receives, do not try to analyse it.

@@ -520,10 +520,6 @@ static struct sk_buff *ip_rcv_core(struct sk_buff *skb, struct net *net)
 	}
 
 	drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
-	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
-		goto inhdr_error;
-
-	iph = ip_hdr(skb);
 
 	/*
 	 *	RFC1122: 3.2.1.2 MUST silently discard any IP frame that fails the checksum.

@@ -536,7 +532,8 @@ static struct sk_buff *ip_rcv_core(struct sk_buff *skb, struct net *net)
 	 *	4.	Doesn't have a bogus length
 	 */
 
-	if (iph->ihl < 5 || iph->version != 4)
+	iph = ip4_parse(skb, 0, &thoff);
+	if (!iph)
 		goto inhdr_error;
 
 	BUILD_BUG_ON(IPSTATS_MIB_ECT1PKTS != IPSTATS_MIB_NOECTPKTS + INET_ECN_ECT_1);

@@ -546,7 +543,7 @@ static struct sk_buff *ip_rcv_core(struct sk_buff *skb, struct net *net)
 		       IPSTATS_MIB_NOECTPKTS + (iph->tos & INET_ECN_MASK),
 		       max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
 
-	if (!pskb_may_pull(skb, iph->ihl*4))
+	if (!pskb_may_pull(skb, thoff))
 		goto inhdr_error;
 
 	iph = ip_hdr(skb);

@@ -559,7 +556,7 @@ static struct sk_buff *ip_rcv_core(struct sk_buff *skb, struct net *net)
 		drop_reason = SKB_DROP_REASON_PKT_TOO_SMALL;
 		__IP_INC_STATS(net, IPSTATS_MIB_INTRUNCATEDPKTS);
 		goto drop;
-	} else if (len < (iph->ihl*4))
+	} else if (len < thoff)
 		goto inhdr_error;
 
 	/* Our transport medium may have padded the buffer out. Now we know it

net/ipv4/netfilter/nf_reject_ipv4.c +5 -8

index 59ec465a9df9..42d639854ddf 100644
@@ -25,22 +25,19 @@ nf_reject_ip_tcphdr_get(struct sk_buff *oldskb,
 static int nf_reject_iphdr_validate(struct sk_buff *skb)
 {
 	struct iphdr *iph;
-	u32 len;
+	u32 len, thoff;
 
-	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
-		return 0;
-
-	iph = ip_hdr(skb);
-	if (iph->ihl < 5 || iph->version != 4)
+	iph = ip4_parse(skb, 0, &thoff);
+	if (!iph)
 		return 0;
 
 	len = ntohs(iph->tot_len);
 	if (skb->len < len)
 		return 0;
-	else if (len < (iph->ihl*4))
+	else if (len < thoff)
 		return 0;
 
-	if (!pskb_may_pull(skb, iph->ihl*4))
+	if (!pskb_may_pull(skb, thoff))
 		return 0;
 
 	return 1;

Signature · 1 line

MST

The following patch will add ingress resolution of uncommon virtio net hdr checksum metadata (software checksum completion at ingress) which adds performance overhead to the packet processing.

We should make it visible, so a hypothetical workload relying on uncommon metadata can be distinguished from none at all. This way issues in the parsing will be reported and not quietly pay the host-CPU checksum overhead instead of offload.

Flip every call to virtio_net_hdr_to_skb to test for negative errno only. The um vector raw transport even ignored the return value
altogether: rejected packets went on into the stack with their metadata unvalidated, so check it there as well.

Have tun, tap and virtio_net count these events per device as rx_csum_sw, exposed via ethtool -S.

Signed-off-by Michael S. Tsirkin <[email protected]>

---
 arch/um/drivers/vector_transports.c |  4 ++-
 drivers/net/ipvlan/ipvtap.c         | 36 +++++++++++++++++++++++++
 drivers/net/macvtap.c               | 36 +++++++++++++++++++++++++
 drivers/net/tap.c                   |  8 ++++--
 drivers/net/tun.c                   | 41 +++++++++++++++++++++++++++--
 drivers/net/virtio_net.c            | 15 ++++++++---
 include/linux/if_tap.h              |  1 +
 net/packet/af_packet.c              |  4 +--
 8 files changed, 135 insertions(+), 10 deletions(-)

arch/um/drivers/vector_transports.c +3 -1

index e1fb2a76fdff..8b7548458663 100644
@@ -210,7 +210,9 @@ static int raw_verify_header(
 		return 1;
 
 	skb_set_network_header(skb, ETH_HLEN);
-	virtio_net_hdr_to_skb(skb, vheader, virtio_legacy_is_little_endian());
+	if (virtio_net_hdr_to_skb(skb, vheader,
+			virtio_legacy_is_little_endian()) < 0)
+		return -1;
 	return 0;
 }
 

drivers/net/ipvlan/ipvtap.c +27 -0

index 66c949d94261..9e2f1c7073d2 100644
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 #include <linux/etherdevice.h>
+#include <linux/ethtool.h>
 #include "ipvlan.h"
 #include <linux/if_vlan.h>
 #include <linux/if_tap.h>

@@ -74,6 +75,32 @@ static void ipvtap_update_features(struct tap_dev *tap,
 	netdev_update_features(vlan->dev);
 }
 
+static int ipvtap_get_sset_count(struct net_device *dev, int sset)
+{
+	return sset == ETH_SS_STATS ? 1 : -EOPNOTSUPP;
+}
+
+static void ipvtap_get_strings(struct net_device *dev, u32 stringset,
+			       u8 *data)
+{
+	if (stringset == ETH_SS_STATS)
+		ethtool_puts(&data, "rx_csum_sw");
+}
+
+static void ipvtap_get_ethtool_stats(struct net_device *dev,
+				     struct ethtool_stats *stats,
+				     u64 *data)
+{
+	struct ipvtap_dev *vlantap = netdev_priv(dev);
+
+	data[0] = atomic64_read(&vlantap->tap.rx_csum_sw);
+}
+
+/* checkpatch warns but this can't be const: cloned from ipvlan's
+ * ops at newlink time, with the statistics above added.
+ */
+static struct ethtool_ops ipvtap_ethtool_ops;
+
 static int ipvtap_newlink(struct net_device *dev,
 			  struct rtnl_newlink_params *params,
 			  struct netlink_ext_ack *extack)

@@ -91,6 +118,15 @@ static int ipvtap_newlink(struct net_device *dev,
 	vlantap->tap.update_features =	ipvtap_update_features;
 	vlantap->tap.count_rx_dropped = ipvtap_count_rx_dropped;

drivers/net/ipvlan/ipvtap.c +0 -0

 	err = netdev_rx_handler_register(dev, tap_handle_frame, &vlantap->tap);
 	if (err)
 		return err;

drivers/net/macvtap.c +36 -0

index cc975dfb7380..3288cc6ae6c2 100644
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 #include <linux/etherdevice.h>
+#include <linux/ethtool.h>
 #include <linux/if_macvlan.h>
 #include <linux/if_tap.h>
 #include <linux/if_vlan.h>

@@ -78,6 +79,32 @@ static void macvtap_update_features(struct tap_dev *tap,
 	netdev_update_features(vlan->dev);
 }
 
+static int macvtap_get_sset_count(struct net_device *dev, int sset)
+{
+	return sset == ETH_SS_STATS ? 1 : -EOPNOTSUPP;
+}
+
+static void macvtap_get_strings(struct net_device *dev, u32 stringset,
+				u8 *data)
+{
+	if (stringset == ETH_SS_STATS)
+		ethtool_puts(&data, "rx_csum_sw");
+}
+
+static void macvtap_get_ethtool_stats(struct net_device *dev,
+				      struct ethtool_stats *stats,
+				      u64 *data)
+{
+	struct macvtap_dev *vlantap = netdev_priv(dev);
+
+	data[0] = atomic64_read(&vlantap->tap.rx_csum_sw);
+}
+
+/* checkpatch warns but this can't be const: cloned from macvlan's
+ * ops at newlink time, with the statistics above added.
+ */
+static struct ethtool_ops macvtap_ethtool_ops;
+
 static int macvtap_newlink(struct net_device *dev,
 			   struct rtnl_newlink_params *params,
 			   struct netlink_ext_ack *extack)

@@ -99,6 +126,15 @@ static int macvtap_newlink(struct net_device *dev,
 	vlantap->tap.count_rx_dropped = macvtap_count_rx_dropped;
 	vlantap->tap.update_features  = macvtap_update_features;
 
+	/* macvlan's ethtool ops are already installed at this point;
+	 * clone them and add the tap statistics on top.
+	 */
+	macvtap_ethtool_ops = *dev->ethtool_ops;
+	macvtap_ethtool_ops.get_sset_count = macvtap_get_sset_count;
+	macvtap_ethtool_ops.get_strings = macvtap_get_strings;
+	macvtap_ethtool_ops.get_ethtool_stats = macvtap_get_ethtool_stats;
+	dev->ethtool_ops = &macvtap_ethtool_ops;
+
 	err = netdev_rx_handler_register(dev, tap_handle_frame, &vlantap->tap);
 	if (err)
 		return err;

drivers/net/tap.c +3 -1

index ff67d99deb39..d7520622e809 100644
@@ -649,11 +649,13 @@ static ssize_t tap_get_user(struct tap_queue *q, void *msg_control,
 
 	if (vnet_hdr_len) {
 		err = tun_vnet_hdr_to_skb(q->flags, skb, &vnet_hdr);
-		if (err) {
+		if (err < 0) {
 			rcu_read_unlock();
 			drop_reason = SKB_DROP_REASON_DEV_HDR;
 			goto err_kfree;
 		}
+		if (err > 0)
+			atomic64_inc(&tap->rx_csum_sw);
 	}
 
 	skb_probe_transport_header(skb);

drivers/net/tap.c +0 -0

 	}
 
 	skb_probe_transport_header(skb);

drivers/net/tun.c +39 -2

index 242899f7fd07..19cb443c89b0 100644
@@ -210,6 +210,7 @@ struct tun_struct {
 	u32 flow_count;
 	u32 rx_batched;
 	atomic_long_t rx_frame_errors;
+	atomic64_t rx_csum_sw;
 	struct bpf_prog __rcu *xdp_prog;
 	struct tun_prog __rcu *steering_prog;
 	struct tun_prog __rcu *filter_prog;

@@ -1935,11 +1936,16 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
 		break;
 	}
 
-	if (tun_vnet_hdr_tnl_to_skb(tun->flags, features, skb, &hdr)) {
+	err = tun_vnet_hdr_tnl_to_skb(tun->flags, features, skb, &hdr);
+	if (err < 0) {
 		atomic_long_inc(&tun->rx_frame_errors);
 		err = -EINVAL;
 		goto free_skb;
 	}
+	if (err > 0) {
+		atomic64_inc(&tun->rx_csum_sw);
+		err = 0;
+	}
 
 	if ((tun->flags & TUN_TYPE_MASK) == IFF_TAP)
 		skb->protocol = eth_type_trans(skb, tun->dev);

@@ -2605,12 +2611,15 @@ static int tun_xdp_one(struct tun_struct *tun,
 	tnl_hdr = (struct virtio_net_hdr_v1_hash_tunnel *)gso;
 	skb->dev = tun->dev;
 	skb_set_network_header(skb, ETH_HLEN);
-	if (tun_vnet_hdr_tnl_to_skb(tun->flags, features, skb, tnl_hdr)) {
+	ret = tun_vnet_hdr_tnl_to_skb(tun->flags, features, skb, tnl_hdr);
+	if (ret < 0) {
 		atomic_long_inc(&tun->rx_frame_errors);
 		kfree_skb(skb);
 		ret = -EINVAL;
 		goto out;
 	}
+	if (ret > 0)
+		atomic64_inc(&tun->rx_csum_sw);
 
 	skb->protocol = eth_type_trans(skb, tun->dev);
 	skb_reset_network_header(skb);

@@ -3739,7 +3748,35 @@ static void tun_get_channels(struct net_device *dev,
 	channels->max_combined = tun->flags & IFF_MULTI_QUEUE ? MAX_TAP_QUEUES : 1;
 }
 
+#define TUN_STATS_LEN	1
+static const char tun_ethtool_strings[TUN_STATS_LEN][ETH_GSTRING_LEN] = {
+	"rx_csum_sw",
+};
+
+static int tun_get_sset_count(struct net_device *dev, int sset)
+{
+	return sset == ETH_SS_STATS ? TUN_STATS_LEN : -EOPNOTSUPP;
+}
+
+static void tun_get_strings(struct net_device *dev, u32 stringset, u8 *data)
+{
+	if (stringset == ETH_SS_STATS)
+		memcpy(data, tun_ethtool_strings,
+		       sizeof(tun_ethtool_strings));
+}
+
+static void tun_get_ethtool_stats(struct net_device *dev,
+				  struct ethtool_stats *stats, u64 *data)
+{
+	struct tun_struct *tun = netdev_priv(dev);
+
+	data[0] = atomic64_read(&tun->rx_csum_sw);
+}
+
 static const struct ethtool_ops tun_ethtool_ops = {
+	.get_sset_count		= tun_get_sset_count,
+	.get_strings		= tun_get_strings,
+	.get_ethtool_stats	= tun_get_ethtool_stats,
 	.supported_coalesce_params = ETHTOOL_COALESCE_RX_MAX_FRAMES,
 	.get_drvinfo	= tun_get_drvinfo,
 	.get_msglevel	= tun_get_msglevel,

drivers/net/virtio_net.c +7 -3

index daab43ac92ce..b0441bf8e875 100644
@@ -125,6 +125,7 @@ struct virtnet_rq_stats {
 	u64_stats_t packets;
 	u64_stats_t bytes;
 	u64_stats_t drops;
+	u64_stats_t rx_csum_sw;
 	u64_stats_t xdp_packets;
 	u64_stats_t xdp_tx;
 	u64_stats_t xdp_redirects;

@@ -158,6 +159,7 @@ static const struct virtnet_stat_desc virtnet_sq_stats_desc[] = {
 
 static const struct virtnet_stat_desc virtnet_rq_stats_desc[] = {
 	VIRTNET_RQ_STAT("drops",         drops),
+	VIRTNET_RQ_STAT("rx_csum_sw",    rx_csum_sw),
 	VIRTNET_RQ_STAT("xdp_packets",   xdp_packets),
 	VIRTNET_RQ_STAT("xdp_tx",        xdp_tx),
 	VIRTNET_RQ_STAT("xdp_redirects", xdp_redirects),

@@ -2502,6 +2504,7 @@ static void virtnet_receive_done(struct virtnet_info *vi, struct receive_queue *
 {
 	struct virtio_net_common_hdr *hdr;
 	struct net_device *dev = vi->dev;
+	int ret;
 
 	hdr = skb_vnet_common_hdr(skb);
 	if (dev->features & NETIF_F_RXHASH && vi->has_rss_hash_report)

@@ -2517,15 +2520,21 @@ static void virtnet_receive_done(struct virtnet_info *vi, struct receive_queue *
 
 	skb->dev = dev;
 	skb_set_network_header(skb, ETH_HLEN);
-	if (virtio_net_hdr_tnl_to_skb(skb, &hdr->tnl_hdr, vi->rx_tnl,
-				      vi->rx_tnl_csum,
-				      virtio_is_little_endian(vi->vdev))) {
+	ret = virtio_net_hdr_tnl_to_skb(skb, &hdr->tnl_hdr, vi->rx_tnl,
+					vi->rx_tnl_csum,
+					virtio_is_little_endian(vi->vdev));
+	if (ret < 0) {
 		net_warn_ratelimited("%s: bad gso: type: %x, size: %u, flags %x tunnel %d tnl csum %d\n",

stats.syncp).

drivers/net/virtio_net.c +0 -0

 	skb_record_rx_queue(skb, vq2rxq(rq->vq));
 	skb->protocol = eth_type_trans(skb, dev);

include/linux/if_tap.h +1 -0

index 553552fa635c..4eac24bb1df7 100644
@@ -41,6 +41,7 @@ struct tap_dev {
 	struct list_head	queue_list;
 	int			numvtaps;
 	int			numqueues;
+	atomic64_t		rx_csum_sw;
 	netdev_features_t	tap_features;
 	int			minor;
 

net/packet/af_packet.c +2 -2

index 52ae3d875e97..e6aec9ecfa99 100644
@@ -2913,7 +2913,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 		}
 
 		if (has_vnet_hdr) {
-			if (virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le())) {
+			if (virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le()) < 0) {
 				tp_len = -EINVAL;
 				goto tpacket_error;
 			}

@@ -3136,7 +3136,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 
 	if (vnet_hdr_sz) {
 		err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le());
-		if (err)
+		if (err < 0)
 			goto out_free;
 		len += vnet_hdr_sz;
 	}

Signature · 1 line

MST

Quoted 91 lines · Michael S. Tsirkin

The following patch will add ingress resolution of uncommon virtio net hdr checksum metadata (software checksum completion at ingress) which adds performance overhead to the packet processing.

We should make it visible, so a hypothetical workload relying on uncommon metadata can be distinguished from none at all. This way issues in the parsing will be reported and not quietly pay the host-CPU checksum overhead instead of offload.

Flip every call to virtio_net_hdr_to_skb to test for negative errno only. The um vector raw transport even ignored the return value
altogether: rejected packets went on into the stack with their metadata unvalidated, so check it there as well.

Have tun, tap and virtio_net count these events per device as rx_csum_sw, exposed via ethtool -S.

Signed-off-by Michael S. Tsirkin <[email protected]>

---
 arch/um/drivers/vector_transports.c |  4 ++-
 drivers/net/ipvlan/ipvtap.c         | 36 +++++++++++++++++++++++++
 drivers/net/macvtap.c               | 36 +++++++++++++++++++++++++
 drivers/net/tap.c                   |  8 ++++--
 drivers/net/tun.c                   | 41 +++++++++++++++++++++++++++--
 drivers/net/virtio_net.c            | 15 ++++++++---
 include/linux/if_tap.h              |  1 +
 net/packet/af_packet.c              |  4 +--
 8 files changed, 135 insertions(+), 10 deletions(-)

arch/um/drivers/vector_transports.c +3 -1

index e1fb2a76fdff..8b7548458663 100644
@@ -210,7 +210,9 @@ static int raw_verify_header(
 		return 1;
 
 	skb_set_network_header(skb, ETH_HLEN);
-	virtio_net_hdr_to_skb(skb, vheader, virtio_legacy_is_little_endian());
+	if (virtio_net_hdr_to_skb(skb, vheader,
+			virtio_legacy_is_little_endian()) < 0)
+		return -1;
 	return 0;
 }
 

drivers/net/ipvlan/ipvtap.c +27 -0

index 66c949d94261..9e2f1c7073d2 100644
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 #include <linux/etherdevice.h>
+#include <linux/ethtool.h>
 #include "ipvlan.h"
 #include <linux/if_vlan.h>
 #include <linux/if_tap.h>

@@ -74,6 +75,32 @@ static void ipvtap_update_features(struct tap_dev *tap,
 	netdev_update_features(vlan->dev);
 }
 
+static int ipvtap_get_sset_count(struct net_device *dev, int sset)
+{
+	return sset == ETH_SS_STATS ? 1 : -EOPNOTSUPP;
+}
+
+static void ipvtap_get_strings(struct net_device *dev, u32 stringset,
+			       u8 *data)
+{
+	if (stringset == ETH_SS_STATS)
+		ethtool_puts(&data, "rx_csum_sw");
+}
+
+static void ipvtap_get_ethtool_stats(struct net_device *dev,
+				     struct ethtool_stats *stats,
+				     u64 *data)
+{
+	struct ipvtap_dev *vlantap = netdev_priv(dev);
+
+	data[0] = atomic64_read(&vlantap->tap.rx_csum_sw);
+}
+
+/* checkpatch warns but this can't be const: cloned from ipvlan's
+ * ops at newlink time, with the statistics above added.
+ */
+static struct ethtool_ops ipvtap_ethtool_ops;
+
 static int ipvtap_newlink(struct net_device *dev,
 			  struct rtnl_newlink_params *params,
 			  struct netlink_ext_ack *extack)

@@ -91,6 +118,15 @@ static int ipvtap_newlink(struct net_device *dev,
 	vlantap->tap.update_features =	ipvtap_update_features;
 	vlantap->tap.count_rx_dropped = ipvtap_count_rx_dropped;

drivers/net/ipvlan/ipvtap.c static int ipvtap_newlink(struct net_device *dev, · line 129

Quoted 10 lines

drivers/net/ipvlan/ipvtap.c +9 -0

 
+	/* ipvlan's ethtool ops are already installed at this point;
+	 * clone them and add the tap statistics on top.
+	 */
+	ipvtap_ethtool_ops = *dev->ethtool_ops;
+	ipvtap_ethtool_ops.get_sset_count = ipvtap_get_sset_count;
+	ipvtap_ethtool_ops.get_strings = ipvtap_get_strings;
+	ipvtap_ethtool_ops.get_ethtool_stats = ipvtap_get_ethtool_stats;
+	dev->ethtool_ops = &ipvtap_ethtool_ops;
+

LLM:

This cloning pattern in ipvtap_newlink (and identically in macvtap_newlink below) has serious concurrency and hardening issues:
1. Concurrent Data Race: ipvtap_ethtool_ops is a single static global struct. Although newlink runs under rtnl_lock(), ethtool readers on existing devices (e.g. netlink stats_prepare_data() and strset_prepare_data()) run under rcu_read_lock() without RTNL. Whenever a new ipvtap/macvtap device is created, ipvtap_ethtool_ops = *dev->ethtool_ops overwrites the global ops table in-place, temporarily clearing get_sset_count and get_strings to NULL before re-populating them. Any concurrent ethtool query on an existing device can observe NULL or torn function pointers.
2. Writable Function Pointer Table: ethtool_ops contains function pointers and should reside in .rodata (const) to prevent kernel exploit targets.
3. Hardcoded Set Count: ipvtap_get_sset_count returns 1 unconditionally; if the lower device ever adds ethtool stats in the future, they are completely masked.

Instead of dynamically mutating a non-const global ops struct on every newlink, either:
• Export the base ops from macvlan/ipvlan so tap can declare a const struct ethtool_ops directly, or
• At the very least, initialize it once (e.g. guarded by a check or at module init) so it is not re-clobbered while readers are active.

Additionally, in general, ipvlan/macvlan/tun/tap changes are preferred to be individual patches.

I don't think this is as important as the main patches 4 and 5. If you want to submit quickly, I would drop/postpone these second order features. Maybe go back to the previous tun-only counter for now, if you consider that important enough.

Quoted 83 lines

drivers/net/ipvlan/ipvtap.c +0 -0

 	err = netdev_rx_handler_register(dev, tap_handle_frame, &vlantap->tap);
 	if (err)
 		return err;

drivers/net/macvtap.c +36 -0

index cc975dfb7380..3288cc6ae6c2 100644
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 #include <linux/etherdevice.h>
+#include <linux/ethtool.h>
 #include <linux/if_macvlan.h>
 #include <linux/if_tap.h>
 #include <linux/if_vlan.h>

@@ -78,6 +79,32 @@ static void macvtap_update_features(struct tap_dev *tap,
 	netdev_update_features(vlan->dev);
 }
 
+static int macvtap_get_sset_count(struct net_device *dev, int sset)
+{
+	return sset == ETH_SS_STATS ? 1 : -EOPNOTSUPP;
+}
+
+static void macvtap_get_strings(struct net_device *dev, u32 stringset,
+				u8 *data)
+{
+	if (stringset == ETH_SS_STATS)
+		ethtool_puts(&data, "rx_csum_sw");
+}
+
+static void macvtap_get_ethtool_stats(struct net_device *dev,
+				      struct ethtool_stats *stats,
+				      u64 *data)
+{
+	struct macvtap_dev *vlantap = netdev_priv(dev);
+
+	data[0] = atomic64_read(&vlantap->tap.rx_csum_sw);
+}
+
+/* checkpatch warns but this can't be const: cloned from macvlan's
+ * ops at newlink time, with the statistics above added.
+ */
+static struct ethtool_ops macvtap_ethtool_ops;
+
 static int macvtap_newlink(struct net_device *dev,
 			   struct rtnl_newlink_params *params,
 			   struct netlink_ext_ack *extack)

@@ -99,6 +126,15 @@ static int macvtap_newlink(struct net_device *dev,
 	vlantap->tap.count_rx_dropped = macvtap_count_rx_dropped;
 	vlantap->tap.update_features  = macvtap_update_features;
 
+	/* macvlan's ethtool ops are already installed at this point;
+	 * clone them and add the tap statistics on top.
+	 */
+	macvtap_ethtool_ops = *dev->ethtool_ops;
+	macvtap_ethtool_ops.get_sset_count = macvtap_get_sset_count;
+	macvtap_ethtool_ops.get_strings = macvtap_get_strings;
+	macvtap_ethtool_ops.get_ethtool_stats = macvtap_get_ethtool_stats;
+	dev->ethtool_ops = &macvtap_ethtool_ops;
+
 	err = netdev_rx_handler_register(dev, tap_handle_frame, &vlantap->tap);
 	if (err)
 		return err;

drivers/net/tap.c +3 -1

index ff67d99deb39..d7520622e809 100644
@@ -649,11 +649,13 @@ static ssize_t tap_get_user(struct tap_queue *q, void *msg_control,
 
 	if (vnet_hdr_len) {
 		err = tun_vnet_hdr_to_skb(q->flags, skb, &vnet_hdr);
-		if (err) {
+		if (err < 0) {
 			rcu_read_unlock();
 			drop_reason = SKB_DROP_REASON_DEV_HDR;
 			goto err_kfree;
 		}
+		if (err > 0)
+			atomic64_inc(&tap->rx_csum_sw);
 	}
 
 	skb_probe_transport_header(skb);

drivers/net/tap.c static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp) · line 1094

Quoted 10 lines

drivers/net/tap.c +3 -1

@@ -1084,10 +1086,12 @@ static int tap_get_user_xdp(struct tap_queue *q, struct xdp_buff *xdp)
 
 	if (vnet_hdr_len) {
 		err = tun_vnet_hdr_to_skb(q->flags, skb, gso);
-		if (err) {
+		if (err < 0) {
 			rcu_read_unlock();
 			goto err_kfree;
 		}
+		if (err > 0)
+			atomic64_inc(&tap->rx_csum_sw);

(repeat) reset err to 0 in all paths.

Quoted 126 lines

drivers/net/tap.c +0 -0

 	}
 
 	skb_probe_transport_header(skb);

drivers/net/tun.c +39 -2

index 242899f7fd07..19cb443c89b0 100644
@@ -210,6 +210,7 @@ struct tun_struct {
 	u32 flow_count;
 	u32 rx_batched;
 	atomic_long_t rx_frame_errors;
+	atomic64_t rx_csum_sw;
 	struct bpf_prog __rcu *xdp_prog;
 	struct tun_prog __rcu *steering_prog;
 	struct tun_prog __rcu *filter_prog;

@@ -1935,11 +1936,16 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
 		break;
 	}
 
-	if (tun_vnet_hdr_tnl_to_skb(tun->flags, features, skb, &hdr)) {
+	err = tun_vnet_hdr_tnl_to_skb(tun->flags, features, skb, &hdr);
+	if (err < 0) {
 		atomic_long_inc(&tun->rx_frame_errors);
 		err = -EINVAL;
 		goto free_skb;
 	}
+	if (err > 0) {
+		atomic64_inc(&tun->rx_csum_sw);
+		err = 0;
+	}
 
 	if ((tun->flags & TUN_TYPE_MASK) == IFF_TAP)
 		skb->protocol = eth_type_trans(skb, tun->dev);

@@ -2605,12 +2611,15 @@ static int tun_xdp_one(struct tun_struct *tun,
 	tnl_hdr = (struct virtio_net_hdr_v1_hash_tunnel *)gso;
 	skb->dev = tun->dev;
 	skb_set_network_header(skb, ETH_HLEN);
-	if (tun_vnet_hdr_tnl_to_skb(tun->flags, features, skb, tnl_hdr)) {
+	ret = tun_vnet_hdr_tnl_to_skb(tun->flags, features, skb, tnl_hdr);
+	if (ret < 0) {
 		atomic_long_inc(&tun->rx_frame_errors);
 		kfree_skb(skb);
 		ret = -EINVAL;
 		goto out;
 	}
+	if (ret > 0)
+		atomic64_inc(&tun->rx_csum_sw);
 
 	skb->protocol = eth_type_trans(skb, tun->dev);
 	skb_reset_network_header(skb);

@@ -3739,7 +3748,35 @@ static void tun_get_channels(struct net_device *dev,
 	channels->max_combined = tun->flags & IFF_MULTI_QUEUE ? MAX_TAP_QUEUES : 1;
 }
 
+#define TUN_STATS_LEN	1
+static const char tun_ethtool_strings[TUN_STATS_LEN][ETH_GSTRING_LEN] = {
+	"rx_csum_sw",
+};
+
+static int tun_get_sset_count(struct net_device *dev, int sset)
+{
+	return sset == ETH_SS_STATS ? TUN_STATS_LEN : -EOPNOTSUPP;
+}
+
+static void tun_get_strings(struct net_device *dev, u32 stringset, u8 *data)
+{
+	if (stringset == ETH_SS_STATS)
+		memcpy(data, tun_ethtool_strings,
+		       sizeof(tun_ethtool_strings));
+}
+
+static void tun_get_ethtool_stats(struct net_device *dev,
+				  struct ethtool_stats *stats, u64 *data)
+{
+	struct tun_struct *tun = netdev_priv(dev);
+
+	data[0] = atomic64_read(&tun->rx_csum_sw);
+}
+
 static const struct ethtool_ops tun_ethtool_ops = {
+	.get_sset_count		= tun_get_sset_count,
+	.get_strings		= tun_get_strings,
+	.get_ethtool_stats	= tun_get_ethtool_stats,
 	.supported_coalesce_params = ETHTOOL_COALESCE_RX_MAX_FRAMES,
 	.get_drvinfo	= tun_get_drvinfo,
 	.get_msglevel	= tun_get_msglevel,

drivers/net/virtio_net.c +7 -3

index daab43ac92ce..b0441bf8e875 100644
@@ -125,6 +125,7 @@ struct virtnet_rq_stats {
 	u64_stats_t packets;
 	u64_stats_t bytes;
 	u64_stats_t drops;
+	u64_stats_t rx_csum_sw;
 	u64_stats_t xdp_packets;
 	u64_stats_t xdp_tx;
 	u64_stats_t xdp_redirects;

@@ -158,6 +159,7 @@ static const struct virtnet_stat_desc virtnet_sq_stats_desc[] = {
 
 static const struct virtnet_stat_desc virtnet_rq_stats_desc[] = {
 	VIRTNET_RQ_STAT("drops",         drops),
+	VIRTNET_RQ_STAT("rx_csum_sw",    rx_csum_sw),
 	VIRTNET_RQ_STAT("xdp_packets",   xdp_packets),
 	VIRTNET_RQ_STAT("xdp_tx",        xdp_tx),
 	VIRTNET_RQ_STAT("xdp_redirects", xdp_redirects),

@@ -2502,6 +2504,7 @@ static void virtnet_receive_done(struct virtnet_info *vi, struct receive_queue *
 {
 	struct virtio_net_common_hdr *hdr;
 	struct net_device *dev = vi->dev;
+	int ret;
 
 	hdr = skb_vnet_common_hdr(skb);
 	if (dev->features & NETIF_F_RXHASH && vi->has_rss_hash_report)

@@ -2517,15 +2520,21 @@ static void virtnet_receive_done(struct virtnet_info *vi, struct receive_queue *
 
 	skb->dev = dev;
 	skb_set_network_header(skb, ETH_HLEN);
-	if (virtio_net_hdr_tnl_to_skb(skb, &hdr->tnl_hdr, vi->rx_tnl,
-				      vi->rx_tnl_csum,
-				      virtio_is_little_endian(vi->vdev))) {
+	ret = virtio_net_hdr_tnl_to_skb(skb, &hdr->tnl_hdr, vi->rx_tnl,
+					vi->rx_tnl_csum,
+					virtio_is_little_endian(vi->vdev));
+	if (ret < 0) {
 		net_warn_ratelimited("%s: bad gso: type: %x, size: %u, flags %x tunnel %d tnl csum %d\n",

drivers/net/virtio_net.c static void virtnet_receive_done(struct virtnet_info *vi, struct receive_queue * · line 2537

Quoted 10 lines

drivers/net/virtio_net.c +5 -0

 				     dev->name, hdr->hdr.gso_type,
 				     hdr->hdr.gso_size, hdr->hdr.flags,
 				     vi->rx_tnl, vi->rx_tnl_csum);
 		goto frame_err;
 	}
+	if (ret > 0) {
+		u64_stats_update_begin(&rq->stats.syncp);
+		u64_stats_inc(&rq->stats.rx_csum_sw);
+		u64_stats_update_end(&rq->stats.syncp);
+	}

Because rx_csum_sw was added to virtnet_rq_stats_desc[], virtnet_poll() already iterates through virtnet_rq_stats_desc[] and syncs each field from the local stack stats into rq->stats at the end of the NAPI polling cycle inside a single u64_stats_update_begin/end(&rq-

Quoted 1 line

stats.syncp).

Calling u64_stats_update_begin/end(&rq->stats.syncp) directly per-packet in virtnet_receive_done() bypasses that batching pattern. While SW csum is off the fast path, it is inconsistent with how other rq stats are handled.

Quoted 40 lines

drivers/net/virtio_net.c +0 -0

 	skb_record_rx_queue(skb, vq2rxq(rq->vq));
 	skb->protocol = eth_type_trans(skb, dev);

include/linux/if_tap.h +1 -0

index 553552fa635c..4eac24bb1df7 100644
@@ -41,6 +41,7 @@ struct tap_dev {
 	struct list_head	queue_list;
 	int			numvtaps;
 	int			numqueues;
+	atomic64_t		rx_csum_sw;
 	netdev_features_t	tap_features;
 	int			minor;
 

net/packet/af_packet.c +2 -2

index 52ae3d875e97..e6aec9ecfa99 100644
@@ -2913,7 +2913,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 		}
 
 		if (has_vnet_hdr) {
-			if (virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le())) {
+			if (virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le()) < 0) {
 				tp_len = -EINVAL;
 				goto tpacket_error;
 			}

@@ -3136,7 +3136,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 
 	if (vnet_hdr_sz) {
 		err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le());
-		if (err)
+		if (err < 0)
 			goto out_free;
 		len += vnet_hdr_sz;
 	}

Signature · 1 line

MST

v4 and I'm pretty tired of this family of issues.

Willem suggested more cleanups, but I don't think I will be able to dedicate much more time to this, there's a pile of fixes I queued that need to get tested and go into rc2, and a bunch of qemu features that need review.

Hopefully if any changes are required this can be done by patches on top, or if someone wants to take over this, very welcome.

------

As reported first by Paulos Yibelo <[email protected]> (after which others, credited below, found more ways the bug can affect users):

allowing untrusted hardware to specify csum start/offset for CHECKSUM_PARTIAL was not a good idea, because, if it edits the packet outside the actual checksum, and depending on the setup, the networking stack could be looking at the packet both before and after the edit, and seeing different results.

Previously, commit 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") validated all known instances where this causes the most grief, but the real fix is to make sure that either only actual checksum fields are ever edited,
or the checksum is completed before the net stack looks at it, so it is always consistent.

This basically goes back to
what we did before f43798c27684 ("tun: Allow GSO using virtio_net_hdr"), except in a narrow list of specified known good cases.

Summary of the patchset:

These are probabably net material (and seem to be too big for stable, or I would recommend backporting there, too):

net: account for ingress-resolved virtio net hdr state
- accounting, not the fix itself, dependency of the fix
um: vector: trim skbs before verifying the header
- fixes the um receive path: without it the checksum would be completed over the unreceived tail of the buffer
virtio_net: parse tunnel csum_start little-endian
- bugfix, a dependency of validating the header
net: resolve uncommon partial checksums at ingress
- fix itself
net: add a sysctl to opt out of virtio net hdr checksum validation
- reducing risk of the fix by adding a sysctl to disable it

These are cleanups, can be deferred to net-next, too:

net: add ip4_parse()
virtio_net: cleanup protocol calculation
- cleanup resulting code duplication
(kept separate to simplify backporting)

Fixes f43798c27684 ("tun: Allow GSO using virtio_net_hdr")

Changes since v1:
- reorder patches to fix bisectability, addressing a comment by Björn Töpel.
- code refactoring, different patch splitup,
a sysctl knob to disable as suggested by Willem de Bruijn.
- fix a bunch of minor issues spotted by LLMs

Changes since v2:

virtio_net: parse tunnel csum_start little-endian
- new patch. correctly parsing the header is a dependency of validating it, otherwise i do not know what to validate

net: account for ingress-resolved virtio net hdr state
- make rx_csum_sw counter 64 bit so it won't wrap (spotted by LLM review)

net: resolve uncommon partial checksums at ingress
- tunnel fixes to bugs noticed by Willem de Bruijn and Chris Arges
- restore the csum_offset checks as suggested by Willem

net: add a sysctl to opt out of virtio net hdr checksum validation
- the knob is no longer writable by root inside a user
namespace: changing it now requires capable(CAP_NET_ADMIN) suggested by Willem de Bruijn

net: add ip4_parse()
- comment converted to kernel-doc format (Willem de Bruijn)

um: vector: trim skbs before verifying the header
- new patch, found by code review

Changes since v3:

net: account for ingress-resolved virtio net hdr state
- um: vector: honor virtio net hdr conversion failures folded in (Björn Töpel)
- count on tap and virtio_net, too (Willem de Bruijn)

net: resolve uncommon partial checksums at ingress
- walk the frame on loopback, too: loopback_xmit() runs eth_type_trans() on it (Willem de Bruijn)
- return the mismatch handling directly, GSO is implied in the tunnel path so drop there outright, and fold the helper into its one remaining caller (Willem de Bruijn)
- read the IP version through struct iphdr (Willem de Bruijn)
- document the ipv6_find_hdr() flags choice

net: add a sysctl to opt out of virtio net hdr checksum validation
- renamed to virtio_net_hdr_validate, in case more validation is gated by the same knob later (Willem de Bruijn)
- point .data at the value like the neighboring entries, the per-netns registration rebases it, and the handler reads the value directly - no ctl_table copy (Björn Töpel, Willem de Bruijn)
- check the opt-out before parsing: with the knob off, packets the parser cannot handle were still dropped (Willem de Bruijn)
- include virtio_net.h in net/core/dev.c so the static key definition sees its declaration (build warning reported by Jakub Kicinski)

net: add ip4_parse()
- add the missing kernel-doc Return: section
(Jakub Kicinski)

Tested: full suite on the final tree, tunnel included. um part compiled only.

Michael S. Tsirkin (7):
net: account for ingress-resolved virtio net hdr state
um: vector: trim skbs before verifying the header
virtio_net: parse tunnel csum_start little-endian
net: resolve uncommon partial checksums at ingress
net: add a sysctl to opt out of virtio net hdr checksum validation
net: add ip4_parse()
virtio_net: cleanup protocol calculation

 Documentation/admin-guide/sysctl/net.rst |  19 +++
 arch/um/drivers/vector_kern.c            |   6 +-
 arch/um/drivers/vector_transports.c      |   4 +-
 drivers/net/ipvlan/ipvtap.c              |  36 ++++
 drivers/net/macvtap.c                    |  36 ++++
 drivers/net/tap.c                        |   8 +-
 drivers/net/tun.c                        |  41 ++++-
 drivers/net/virtio_net.c                 |  14 +-
 include/linux/if_tap.h                   |   1 +
 include/linux/ip.h                       |  30 ++++
 include/linux/virtio_net.h               | 279 ++++++++++++++++++++++++++++++-
 include/net/netns/core.h                 |   1 +
 net/bridge/br_netfilter_hooks.c          |  15 +-
 net/core/dev.c                           |   7 +
 net/core/net_namespace.c                 |   1 +
 net/core/sysctl_net_core.c               |  50 ++++++
 net/ipv4/ip_input.c                      |  13 +-
 net/ipv4/netfilter/nf_reject_ipv4.c      |  13 +-
 net/packet/af_packet.c                   |   4 +-
 19 files changed, 533 insertions(+), 45 deletions(-)

Signature · 1 line

MST