diff options
| author | Alice Mikityanska <alice@isovalent.com> | 2026-08-22 15:01:16 +0300 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2026-08-27 15:47:17 +0200 |
| commit | c27c449d455aafd9018a3cbab150f1c42c87923f (patch) | |
| tree | 6e2e90dcda75d671883820456a2bb0348c49acbf /scripts/kernel-doc | |
| parent | 2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d (diff) | |
| download | linux-c27c449d455aafd9018a3cbab150f1c42c87923f.tar.gz linux-c27c449d455aafd9018a3cbab150f1c42c87923f.zip | |
virtio-net: Ensure that TCP packets don't overflow gso_segs
The user can specify any gso_size in a packet crafted with an AF_PACKET
PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the
same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user
crafts a packet with gso_size < 8, there is a risk for partial GSO to
overflow the 16-bit gso_segs field when dividing the SKB length by
gso_size.
Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep
gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly
tested at tools/testing/selftests/net/tun.c:649.
Fixes: 7c6d2ecbda83 ("net: be more gentle about silly gso requests coming from user")
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Suggested-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260822120117.1163423-2-alice.kernel@fastmail.im
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'scripts/kernel-doc')
0 files changed, 0 insertions, 0 deletions