virtio_net_hdr_tnl_to_skb() decodes hdr->csum_start with the caller's little_endian argument when it validates the inner header offsets, but then calls __virtio_net_hdr_to_skb() with little_endian hard-coded to true. The other tunnel offsets are always decoded as little-endian as well. tun passes tun_vnet_is_little_endian(), which is false when the device uses big-endian legacy headers: by default on big-endian hosts, and after TUNSETVNETBE on little-endian hosts with CONFIG_TUN_VNET_CROSS_LE. The validation and the parser then disagree on csum_start. For example, the bytes 14 00 decode as 5120 for the validation and as 20 for the parser, so an inner_nh_offset beyond the data pulled into the linear area passes the check, and the USO branch reads iphdr->version out of bounds: BUG: KASAN: slab-out-of-bounds in tun_vnet_hdr_tnl_to_skb+0x74b/0x830 Read of size 1 at addr ffff88807999d044 by task kvd-program/9399 Call Trace: tun_vnet_hdr_tnl_to_skb+0x74b/0x830 tun_get_user+0x1827/0x3d00 tun_chr_write_iter+0x113/0x200 vfs_write+0x5c9/0xb30 Decode csum_start as little-endian, matching the parser. Callers that pass little_endian == true are unaffected. Fixes: a2fb4bc4e2a6 ("net: implement virtio helpers to handle UDP GSO tunneling.") Assisted-by: LLM Signed-off-by: Cheng Yongkang --- include/linux/virtio_net.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h index d6466f96cdd0..ddc6341747e5 100644 --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -324,7 +324,7 @@ virtio_net_hdr_tnl_to_skb(struct sk_buff *skb, inner_l3min = virtio_l3min(inner_isv6); outer_l3min = ETH_HLEN + virtio_l3min(outer_isv6); - inner_th = __virtio16_to_cpu(little_endian, hdr->csum_start); + inner_th = le16_to_cpu(hdr->csum_start); inner_nh = le16_to_cpu(vhdr->inner_nh_offset); outer_th = le16_to_cpu(vhdr->outer_th_offset); if (outer_th < outer_l3min || base-commit: f4377bf85887f57b59abb5479f7660a81ffe4449 -- 2.34.1