Re: [PATCH] net: gue: reject invalid REMCSUM offsets

[Simon Horman]

On Thu, Aug 20, 2026 at 10:02:10PM +0000, Jérémy Jean wrote:
> The REMCSUM option carries an absolute checksum start and checksum field
> offset. gue_remcsum() passes them to skb_remcsum_process(), whose
> partial path stores offset - start in the u16 skb->csum_offset. If
> offset is less than start, this underflows (for example, 1/0 becomes
> 0xffff).
> 
> A forwarded packet can retain CHECKSUM_PARTIAL and reach a
> NETIF_F_HW_CSUM driver which trusts the metadata, leading
> skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the
> destination buffer.
> 
> Reject reversed tuples in both normal and GRO receive paths.
> 
> Fixes: fe881ef11cf0 ("gue: Use checksum partial with remote checksum offload")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>