CVE-2024-49948

In the Linux kernel, the following vulnerability has been resolved:

net: add more sanity checks to qdiscpktlen_init()

One path takes care of SKBGSODODGY, assuming skb->len is bigger than hdr_len.

virtionethdrtoskb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes.

It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes.

• 20 bytes of IPv4 header
• 60 bytes TCP header
• a small gso_size like 8

virtionethdrtoskb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size.

We need to make detect this case to not underflow qdiscskbcb(skb)->pkt_len.