Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v3 net] ipv6: Fix dangling pointer when ipv6 fragment
To:     Dan Carpenter <dan.carpenter@oracle.com>, <kbuild@01.org>
CC:     <kbuild-all@01.org>, <davem@davemloft.net>, <kuznet@ms2.inr.ac.ru>,
        <yoshfuji@linux-ipv6.org>, <netdev@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>, <mingfangsen@huawei.com>
References: <20190403050109.GH32613@kadam>
From:   hujunwei <hujunwei4@huawei.com>
Message-ID: <75978908-fbb7-764a-cac6-8be8ceff3ce4@huawei.com>
Date:   Wed, 3 Apr 2019 14:47:19 +0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:60.0) Gecko/20100101
 Thunderbird/60.6.1
MIME-Version: 1.0
In-Reply-To: <20190403050109.GH32613@kadam>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


On 2019/4/3 13:01, Dan Carpenter wrote:
> Hi hujunwei,
> 
> url:    https://github.com/0day-ci/linux/commits/hujunwei/ipv6-Fix-dangling-pointer-when-ipv6-fragment/20190402-175602
> 
> New smatch warnings:
> net/ipv6/ip6_output.c:609 ip6_fragment() error: uninitialized symbol 'prevhdr'.
> 
> Old smatch warnings:
> net/ipv6/ip6_output.c:247 ip6_xmit() error: we previously assumed 'np' could be null (see line 241)
> 
> # https://github.com/0day-ci/linux/commit/7f25fe5b3011737e52e4d8b4a2dfcafd46677115
> git remote add linux-review https://github.com/0day-ci/linux
> git remote update linux-review
> git checkout 7f25fe5b3011737e52e4d8b4a2dfcafd46677115
> vim +/prevhdr +609 net/ipv6/ip6_output.c
> 
> ^1da177e4 Linus Torvalds             2005-04-16  594  
> 7d8c6e391 Eric W. Biederman          2015-06-12  595  int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
> 7d8c6e391 Eric W. Biederman          2015-06-12  596  		 int (*output)(struct net *, struct sock *, struct sk_buff *))
> ^1da177e4 Linus Torvalds             2005-04-16  597  {
> ^1da177e4 Linus Torvalds             2005-04-16  598  	struct sk_buff *frag;
> adf30907d Eric Dumazet               2009-06-02  599  	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
> f60e5990d hannes@stressinduktion.org 2015-04-01  600  	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
> f60e5990d hannes@stressinduktion.org 2015-04-01  601  				inet6_sk(skb->sk) : NULL;
> ^1da177e4 Linus Torvalds             2005-04-16  602  	struct ipv6hdr *tmp_hdr;
> ^1da177e4 Linus Torvalds             2005-04-16  603  	struct frag_hdr *fh;
> 7f25fe5b3 Junwei Hu                  2019-04-02  604  	unsigned int mtu, hlen, left, len, nexthdr_offset;
> a7ae19922 Herbert Xu                 2011-11-18  605  	int hroom, troom;
> 286c2349f Martin KaFai Lau           2015-05-22  606  	__be32 frag_id;
> ^1da177e4 Linus Torvalds             2005-04-16  607  	int ptr, offset = 0, err = 0;
> ^1da177e4 Linus Torvalds             2005-04-16  608  	u8 *prevhdr, nexthdr = 0;
>                                                             ^^^^^^^^
> 7f25fe5b3 Junwei Hu                  2019-04-02 @609  	nexthdr_offset = prevhdr - skb_network_header(skb);
>                                                                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> ---
> 0-DAY kernel test infrastructure                Open Source Technology Center
> https://lists.01.org/pipermail/kbuild-all                   Intel Corporation
> 
> .
> 
Hi Dan,
Thank you for your remind, I sorry for this, i send the patch v4 yesterday. You can get it from the mail list.