Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Message-ID: <45522c89-a3b4-4b98-232b-9c69470124a3@linaro.org>
Date:   Tue, 8 Mar 2022 11:46:07 -0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.5.0
Content-Language: en-US
To:     David Ahern <dsahern@kernel.org>,
        David Laight <David.Laight@ACULAB.COM>,
        "davem@davemloft.net" <davem@davemloft.net>
Cc:     Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
        Jakub Kicinski <kuba@kernel.org>,
        Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        Martin KaFai Lau <kafai@fb.com>,
        Song Liu <songliubraving@fb.com>, Yonghong Song <yhs@fb.com>,
        John Fastabend <john.fastabend@gmail.com>,
        KP Singh <kpsingh@kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "bpf@vger.kernel.org" <bpf@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>,
        "syzbot+e223cf47ec8ae183f2a0@syzkaller.appspotmail.com" 
        <syzbot+e223cf47ec8ae183f2a0@syzkaller.appspotmail.com>
References: <20220308000146.534935-1-tadeusz.struk@linaro.org>
 <14626165dad64bbaabed58ba7d59e523@AcuMS.aculab.com>
 <6155b68c-161b-0745-b303-f7e037b56e28@linaro.org>
 <66463e26-8564-9f58-ce41-9a2843891d1a@kernel.org>
From:   Tadeusz Struk <tadeusz.struk@linaro.org>
Subject: Re: [PATCH] net: ipv6: fix invalid alloclen in __ip6_append_data
In-Reply-To: <66463e26-8564-9f58-ce41-9a2843891d1a@kernel.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 3/8/22 10:18, David Ahern wrote:
>> alloclen = 1480
>> alloc_extra = 136
>> datalen = 64095
>> fragheaderlen = 1480
>> fraglen = 65575
>> transhdrlen = 0
>> mtu = 1480
>>
> Does this solve the problem (whitespace damaged on paste, but it is just
> a code move and removing fraglen getting set twice):
> 
> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index e69fac576970..59f036241f1b 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -1589,6 +1589,15 @@ static int __ip6_append_data(struct sock *sk,
> 
>                          if (datalen > (cork->length <= mtu &&
> !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
>                                  datalen = maxfraglen - fragheaderlen -
> rt->dst.trailer_len;
> +
> +                       if (datalen != length + fraggap) {
> +                               /*
> +                                * this is not the last fragment, the
> trailer
> +                                * space is regarded as data space.
> +                                */
> +                               datalen += rt->dst.trailer_len;
> +                       }
> +
>                          fraglen = datalen + fragheaderlen;
>                          pagedlen = 0;
> 
> @@ -1615,16 +1624,6 @@ static int __ip6_append_data(struct sock *sk,
>                          }
>                          alloclen += alloc_extra;
> 
> -                       if (datalen != length + fraggap) {
> -                               /*
> -                                * this is not the last fragment, the
> trailer
> -                                * space is regarded as data space.
> -                                */
> -                               datalen += rt->dst.trailer_len;
> -                       }
> -
> -                       fraglen = datalen + fragheaderlen;
> -
>                          copy = datalen - transhdrlen - fraggap - pagedlen;
>                          if (copy < 0) {
>                                  err = -EINVAL;

That fails in the same way:

skbuff: skb_over_panic: text:ffffffff83e7b48b len:65575 put:65575 
head:ffff888101f8a000 data:ffff888101f8a088 tail:0x100af end:0x6c0 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:113!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 1852 Comm: repro Not tainted 5.17.0-rc7-00020-gea4424be1688-dirty #19
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35
RIP: 0010:skb_panic+0x173/0x175

I'm not sure how it supposed to help since it doesn't change the alloclen at all.
I think the problem here is that the size of the allocated skb is too small.

-- 
Thanks,
Tadeusz