lkml.org 
[lkml]   [2016]   [Apr]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 213/217] ipv6: Count in extension headers in skb->network_header
    3.16.35-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jakub Sitnicki <jkbs@redhat.com>

    commit 3ba3458fb9c050718b95275a3310b74415e767e2 upstream.

    When sending a UDPv6 message longer than MTU, account for the length
    of fragmentable IPv6 extension headers in skb->network_header offset.
    Same as we do in alloc_new_skb path in __ip6_append_data().

    This ensures that later on __ip6_make_skb() will make space in
    headroom for fragmentable extension headers:

    /* move skb->data to ip header from ext header */
    if (skb->data < skb_network_header(skb))
    __skb_pull(skb, skb_network_offset(skb));

    Prevents a splat due to skb_under_panic:

    skbuff: skb_under_panic: text:ffffffff8143397b len:2126 put:14 \
    head:ffff880005bacf50 data:ffff880005bacf4a tail:0x48 end:0xc0 dev:lo
    ------------[ cut here ]------------
    kernel BUG at net/core/skbuff.c:104!
    invalid opcode: 0000 [#1] KASAN
    CPU: 0 PID: 160 Comm: reproducer Not tainted 4.6.0-rc2 #65
    [...]
    Call Trace:
    [<ffffffff813eb7b9>] skb_push+0x79/0x80
    [<ffffffff8143397b>] eth_header+0x2b/0x100
    [<ffffffff8141e0d0>] neigh_resolve_output+0x210/0x310
    [<ffffffff814eab77>] ip6_finish_output2+0x4a7/0x7c0
    [<ffffffff814efe3a>] ip6_output+0x16a/0x280
    [<ffffffff815440c1>] ip6_local_out+0xb1/0xf0
    [<ffffffff814f1115>] ip6_send_skb+0x45/0xd0
    [<ffffffff81518836>] udp_v6_send_skb+0x246/0x5d0
    [<ffffffff8151985e>] udpv6_sendmsg+0xa6e/0x1090
    [...]

    Reported-by: Ji Jianwen <jiji@redhat.com>
    Signed-off-by: Jakub Sitnicki <jkbs@redhat.com>
    Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [bwh: Backported to 3.16: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/ipv6/ip6_output.c | 9 ++++-----
    1 file changed, 4 insertions(+), 5 deletions(-)

    --- a/net/ipv6/ip6_output.c
    +++ b/net/ipv6/ip6_output.c
    @@ -1049,9 +1049,8 @@ static inline int ip6_ufo_append_data(st
    int getfrag(void *from, char *to, int offset, int len,
    int odd, struct sk_buff *skb),
    void *from, int length, int hh_len, int fragheaderlen,
    - int transhdrlen, int mtu,unsigned int flags,
    - struct rt6_info *rt)
    -
    + int exthdrlen, int transhdrlen, int mtu,
    + unsigned int flags, struct rt6_info *rt)
    {
    struct sk_buff *skb;
    struct frag_hdr fhdr;
    @@ -1075,7 +1074,7 @@ static inline int ip6_ufo_append_data(st
    skb_put(skb,fragheaderlen + transhdrlen);

    /* initialize network header pointer */
    - skb_reset_network_header(skb);
    + skb_set_network_header(skb, exthdrlen);

    /* initialize protocol header pointer */
    skb->transport_header = skb->network_header + fragheaderlen;
    @@ -1300,7 +1299,7 @@ emsgsize:
    (rt->dst.dev->features & NETIF_F_UFO) &&
    (sk->sk_type == SOCK_DGRAM)) {
    err = ip6_ufo_append_data(sk, getfrag, from, length,
    - hh_len, fragheaderlen,
    + hh_len, fragheaderlen, exthdrlen,
    transhdrlen, mtu, flags, rt);
    if (err)
    goto error;
    \
     
     \ /
      Last update: 2016-04-27 02:41    [W:3.167 / U:0.196 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site