tun: add missing verification for short frame

JIRA: https://issues.redhat.com/browse/RHEL-50203
CVE: CVE-2024-41091
Upstream Status: Posted https://lore.kernel.org/r/20240724170452.16837-3-dongli.zhang@oracle.com/

Author: Dongli Zhang <dongli.zhang@oracle.com>
Date:   Wed Jul 24 10:04:52 2024 -0700

    tun: add missing verification for short frame

    The cited commit missed to check against the validity of the frame length
    in the tun_xdp_one() path, which could cause a corrupted skb to be sent
    downstack. Even before the skb is transmitted, the
    tun_xdp_one-->eth_type_trans() may access the Ethernet header although it
    can be less than ETH_HLEN. Once transmitted, this could either cause
    out-of-bound access beyond the actual length, or confuse the underlayer
    with incorrect or inconsistent header length in the skb metadata.

    In the alternative path, tun_get_user() already prohibits short frame which
    has the length less than Ethernet header size from being transmitted for
    IFF_TAP.

    This is to drop any frame shorter than the Ethernet header size just like
    how tun_get_user() does.

    CVE: CVE-2024-41091
    Inspired-by: https://lore.kernel.org/netdev/1717026141-25716-1-git-send-email-si-wei.liu@oracle.com/
    Fixes: 043d222 ("tuntap: accept an array of XDP buffs through sendmsg()")
    Cc: Si-Wei Liu <si-wei.liu@oracle.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Reviewed-by: Paolo Abeni <pabeni@redhat.com>
    Reviewed-by: Jason Wang <jasowang@redhat.com>

Signed-off-by: Patrick Talbert <ptalbert@redhat.com>

Author: ptalbert

drivers/net/tun.c

@@ -2416,6 +2416,9 @@ static int tun_xdp_one(struct tun_struct *tun,
 	bool skb_xdp = false;
 	struct page *page;
 
+	if (unlikely(datasize < ETH_HLEN))
+		return -EINVAL;
+
 	xdp_prog = rcu_dereference(tun->xdp_prog);
 	if (xdp_prog) {
 		if (gso->gso_type) {