Bingquan Chen 2c054e17d9 net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() ...

In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points
directly into the mmap'd TX ring buffer shared with userspace. The
kernel validates the header via __packet_snd_vnet_parse() but then
re-reads all fields later in virtio_net_hdr_to_skb(). A concurrent
userspace thread can modify the vnet_hdr fields between validation
and use, bypassing all safety checks.

The non-TPACKET path (packet_snd()) already correctly copies vnet_hdr
to a stack-local variable. All other vnet_hdr consumers in the kernel
(tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX
path is the only caller of virtio_net_hdr_to_skb() that reads directly
from user-controlled shared memory.

Fix this by copying vnet_hdr from the mmap'd ring buffer to a
stack-local variable before validation and use, consistent with the
approach used in packet_snd() and all other callers.

Fixes: 1d036d25e5 ("packet: tpacket_snd gso and checksum offload")
Signed-off-by: Bingquan Chen <patzilla007@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260418112006.78823-1-patzilla007@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

2026-04-22 20:16:34 -07:00

..

af_packet.c

net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()

2026-04-22 20:16:34 -07:00

diag.c

net: change sock.sk_ino and sock_i_ino() to u64

2026-03-06 14:31:26 +01:00

internal.h

net: af_packet: Use hrtimer to do the retire operation

2025-09-11 18:40:06 -07:00

Kconfig

…

Makefile

…