From 46a02b663ed27bfb377d7798342ea96b0105f7ea Mon Sep 17 00:00:00 2001 From: JackDoan Date: Tue, 28 Jul 2026 10:54:03 -0500 Subject: [PATCH] virtio: reject the GSO_ECN qualifier on non-TCP GSO types 35596c7 added the udp-l4-ecn-rejected test but only the ECN mask, so UDP_L4|ECN validated as plain UDP_L4. Mirror virtio_net_hdr_to_skb and refuse ECN on anything but TCPV4/TCPV6. Co-Authored-By: Claude Fable 5 --- overlay/tio/virtio/segment_linux.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/overlay/tio/virtio/segment_linux.go b/overlay/tio/virtio/segment_linux.go index 4577c7d5..17a7ff00 100644 --- a/overlay/tio/virtio/segment_linux.go +++ b/overlay/tio/virtio/segment_linux.go @@ -87,6 +87,14 @@ func CheckValid(pkt []byte, hdr Hdr) error { //mask out VIRTIO_NET_HDR_GSO_ECN, it's a qualifier, not a type gsoType := hdr.GSOType &^ unix.VIRTIO_NET_HDR_GSO_ECN + // The ECN qualifier means CWR was set on a TSO superpacket, so it only + // applies to the TCP types. The kernel's virtio_net_hdr_to_skb rejects + // it on anything else; mirror that instead of segmenting nonsense. + if hdr.GSOType&unix.VIRTIO_NET_HDR_GSO_ECN != 0 && + gsoType != unix.VIRTIO_NET_HDR_GSO_TCPV4 && + gsoType != unix.VIRTIO_NET_HDR_GSO_TCPV6 { + return fmt.Errorf("virtio GSO_ECN qualifier on non-TCP GSO type %#x", hdr.GSOType) + } switch gsoType { case unix.VIRTIO_NET_HDR_GSO_TCPV4: if ipVersion != 4 {