Re: [PATCH] net: gue: reject invalid REMCSUM offsets

[Eric Dumazet]

On Mon, Aug 24, 2026 at 2:27 PM Simon Horman <horms@xxxxxxxxxx> wrote:
>
> On Thu, Aug 20, 2026 at 10:02:10PM +0000, Jérémy Jean wrote:
> > The REMCSUM option carries an absolute checksum start and checksum field
> > offset. gue_remcsum() passes them to skb_remcsum_process(), whose
> > partial path stores offset - start in the u16 skb->csum_offset. If
> > offset is less than start, this underflows (for example, 1/0 becomes
> > 0xffff).
> >
> > A forwarded packet can retain CHECKSUM_PARTIAL and reach a
> > NETIF_F_HW_CSUM driver which trusts the metadata, leading
> > skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the
> > destination buffer.
> >
> > Reject reversed tuples in both normal and GRO receive paths.
> >
> > Fixes: fe881ef11cf0 ("gue: Use checksum partial with remote checksum offload")
> > Assisted-by: Codex:gpt-5
> > Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
>
> Reviewed-by: Simon Horman <horms@xxxxxxxxxx>

Patch looks fine. I wonder if it would make sense to catch the issue earlier in
a single place ( validate_gue_flags())