lkml.org 
[lkml]   [2022]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] net: ipv6: fix invalid alloclen in __ip6_append_data
On 3/8/22 10:18, David Ahern wrote:
>> alloclen = 1480
>> alloc_extra = 136
>> datalen = 64095
>> fragheaderlen = 1480
>> fraglen = 65575
>> transhdrlen = 0
>> mtu = 1480
>>
> Does this solve the problem (whitespace damaged on paste, but it is just
> a code move and removing fraglen getting set twice):
>
> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index e69fac576970..59f036241f1b 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -1589,6 +1589,15 @@ static int __ip6_append_data(struct sock *sk,
>
> if (datalen > (cork->length <= mtu &&
> !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
> datalen = maxfraglen - fragheaderlen -
> rt->dst.trailer_len;
> +
> + if (datalen != length + fraggap) {
> + /*
> + * this is not the last fragment, the
> trailer
> + * space is regarded as data space.
> + */
> + datalen += rt->dst.trailer_len;
> + }
> +
> fraglen = datalen + fragheaderlen;
> pagedlen = 0;
>
> @@ -1615,16 +1624,6 @@ static int __ip6_append_data(struct sock *sk,
> }
> alloclen += alloc_extra;
>
> - if (datalen != length + fraggap) {
> - /*
> - * this is not the last fragment, the
> trailer
> - * space is regarded as data space.
> - */
> - datalen += rt->dst.trailer_len;
> - }
> -
> - fraglen = datalen + fragheaderlen;
> -
> copy = datalen - transhdrlen - fraggap - pagedlen;
> if (copy < 0) {
> err = -EINVAL;

That fails in the same way:

skbuff: skb_over_panic: text:ffffffff83e7b48b len:65575 put:65575
head:ffff888101f8a000 data:ffff888101f8a088 tail:0x100af end:0x6c0 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:113!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 1852 Comm: repro Not tainted 5.17.0-rc7-00020-gea4424be1688-dirty #19
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35
RIP: 0010:skb_panic+0x173/0x175

I'm not sure how it supposed to help since it doesn't change the alloclen at all.
I think the problem here is that the size of the allocated skb is too small.

--
Thanks,
Tadeusz

\
 
 \ /
  Last update: 2022-09-17 16:16    [W:1.056 / U:0.124 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site