Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Martin Lau <kafai@fb.com>
To:     hujunwei <hujunwei4@huawei.com>
CC:     "davem@davemloft.net" <davem@davemloft.net>,
        "kuznet@ms2.inr.ac.ru" <kuznet@ms2.inr.ac.ru>,
        "yoshfuji@linux-ipv6.org" <yoshfuji@linux-ipv6.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "mingfangsen@huawei.com" <mingfangsen@huawei.com>,
        "liuzhiqiang26@huawei.com" <liuzhiqiang26@huawei.com>,
        "zhangwenhao8@huawei.com" <zhangwenhao8@huawei.com>,
        "wangxiaogang3@huawei.com" <wangxiaogang3@huawei.com>
Subject: Re: [PATCH v2 net] ipv6: Fix dangling pointer when ipv6 fragment
Thread-Topic: [PATCH v2 net] ipv6: Fix dangling pointer when ipv6 fragment
Thread-Index: AQHU56DocPVqow9gSEq5XaL6cFBxjKYngiOA
Date:   Mon, 1 Apr 2019 16:34:01 +0000
Message-ID: <20190401163355.4fokjjbyv3ug7nl3@kafai-mbp.dhcp.thefacebook.com>
References: <cbbedd1f-3e99-85f7-86d7-d02a86d59c29@huawei.com>
 <9104f44b-2ce0-7be9-2fca-8b6c12abbb86@huawei.com>
In-Reply-To: <9104f44b-2ce0-7be9-2fca-8b6c12abbb86@huawei.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [2620:10d:c090:200::3005]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 7886cc75-9c4d-4118-ef88-08d6b6bfd909
x-microsoft-antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(8989299)(5600139)(711020)(4605104)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020);SRVR:MWHPR15MB1565;
x-ms-traffictypediagnostic: MWHPR15MB1565:
x-microsoft-antispam-prvs: <MWHPR15MB1565756B0FFA613769A35BB5D5550@MWHPR15MB1565.namprd15.prod.outlook.com>
x-forefront-prvs: 0994F5E0C5
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(979002)(39860400002)(346002)(376002)(366004)(396003)(136003)(189003)(199004)(54906003)(446003)(6246003)(8676002)(316002)(25786009)(6512007)(9686003)(81156014)(5660300002)(81166006)(99286004)(7736002)(6506007)(1076003)(102836004)(305945005)(6916009)(11346002)(386003)(46003)(229853002)(6436002)(6486002)(4744005)(52116002)(6116002)(71190400001)(71200400001)(8936002)(105586002)(86362001)(186003)(256004)(478600001)(68736007)(76176011)(7416002)(4326008)(106356001)(53936002)(14454004)(476003)(2906002)(486006)(97736004)(969003)(989001)(999001)(1009001)(1019001);DIR:OUT;SFP:1102;SCL:1;SRVR:MWHPR15MB1565;H:MWHPR15MB1790.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: fb.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: eKlY9Dq2rqWokEoJQ9CRmTf4g7WtZaO+y35vYgcX5JXtSIgQh0vjSFZ7rKavWdIQx9oFGcnAoWCzk6X45A2xuMwPk3s0DFejLSi+D1NIOhxWsYBNjpBxruBTytGsdVVKmrAW8RnABlAjkUb8xHrJLLC6dA6uPSWKzxCFnqepodf+f5G+p4VUEBJYg/mbgsVKtreuMZ8bxP5WibmuyyGgK0K7sbmoFFmcw9A5QNtw/wn9aYg4U++e4SuCbFUBwtKQvysoKEdX/TKmVOoe5LBGTRQfAlrKFRto2QYh08K1ME1oOU2YiAhS0wN5pBXG4aFy7KHBGZguoJyBztLc9GCrwpo8aplMivw70Lbn62bVg6yEJE1MjAckDXJJJBbq9IcGINxB9O/PGUouDn+X8euo/QSesPvqZkTrChCcU8sRRS0=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <201CBE20217D8F42AC8DD9235FA65ABD@namprd15.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 7886cc75-9c4d-4118-ef88-08d6b6bfd909
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Apr 2019 16:34:02.0043
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR15MB1565
X-OriginatorOrg: fb.com
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2019-04-01_05:,,
 signatures=0
X-Proofpoint-Spam-Reason: safe
X-FB-Internal: Safe
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sun, Mar 31, 2019 at 05:04:29PM +0800, hujunwei wrote:
> From: Junwei Hu <hujunwei4@huawei.com>
>=20
> At the beginning of ip6_fragment func, the prevhdr pointer is
> obtained in the ip6_find_1stfragopt func.
> However, all the pointers pointing into skb header may change
> when calling skb_checksum_help func with
> skb->ip_summed =3D CHECKSUM_PARTIAL condition.
> The prevhdr pointe will be dangling if it is not reloaded after
> calling __skb_linearize func in skb_checksum_help func.
>=20
> Here, I add a variable, nexthdr_offset, to evaluate the offset,
> which does not changes even after calling __skb_linearize func.
Acked-by: Martin KaFai Lau <kafai@fb.com>