Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:1 as permitted sender) client-ip=2620:137:e000::3:1;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <CANn89iLwMhOnrmQTZJ+BqZJSbJZ+Q4W6xRknAAr+uSrk5TX-EQ@mail.gmail.com>
References: <CANn89iLwMhOnrmQTZJ+BqZJSbJZ+Q4W6xRknAAr+uSrk5TX-EQ@mail.gmail.com> <0000000000001c12b30605378ce8@google.com>
To:     Eric Dumazet <edumazet@google.com>
Cc:     dhowells@redhat.com,
        syzbot <syzbot+62cbf263225ae13ff153@syzkaller.appspotmail.com>,
        bpf@vger.kernel.org, davem@davemloft.net, dsahern@kernel.org,
        kuba@kernel.org, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org, pabeni@redhat.com,
        syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [net?] WARNING in __ip6_append_data
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3793722.1694795079.1@warthog.procyon.org.uk>
Date:   Fri, 15 Sep 2023 17:24:39 +0100
Message-ID: <3793723.1694795079@warthog.procyon.org.uk>
Precedence: bulk

I think the attached is probably an equivalent cleaned up reproducer.  Note
that if the length given to sendfile() is less than 65536, it fails with
EINVAL before it gets into __ip6_append_data().

David
---
#define _GNU_SOURCE
#include <arpa/inet.h>
#include <fcntl.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/sendfile.h>
#include <sys/uio.h>
#include <netinet/ip6.h>
#include <netinet/in.h>

#define IPPROTO_L2TP 115

#define OSERROR(R, S) \
	do { if ((long)(R) == -1L) { perror((S)); exit(1); } } while(0)

static char buffer[16776960];

int main()
{
	struct sockaddr_in6 sin6;
	int ffd, dfd, sfd;

	ffd = openat(AT_FDCWD, "cgroup.controllers",
		     O_RDWR | O_CREAT | O_TRUNC, 0);
	OSERROR(ffd, "cgroup.controllers/f");

	OSERROR(write(ffd, buffer, sizeof(buffer)), "write");

	dfd = openat(AT_FDCWD, "cgroup.controllers",
		     O_RDONLY | O_NONBLOCK | O_DIRECT);
	OSERROR(dfd, "cgroup.controllers/d");

	sfd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP);
	OSERROR(dfd, "socket");

	memset(&sin6, 0, sizeof(sin6));
	sin6.sin6_family = AF_INET6;
	sin6.sin6_port = htons(0);
	sin6.sin6_addr.s6_addr32[0] = htonl(0);
	sin6.sin6_addr.s6_addr32[1] = htonl(0);
	sin6.sin6_addr.s6_addr32[2] = htonl(0);
	sin6.sin6_addr.s6_addr32[3] = htonl(1);
	OSERROR(bind(sfd, (struct sockaddr *)&sin6, 32),
		"bind");

	memset(&sin6, 0, sizeof(sin6));
	sin6.sin6_family = AF_INET6;
	sin6.sin6_port = htons(7);
	sin6.sin6_addr.s6_addr32[0] = htonl(0);
	sin6.sin6_addr.s6_addr32[1] = htonl(0);
	sin6.sin6_addr.s6_addr32[2] = htonl(0);
	sin6.sin6_addr.s6_addr32[3] = htonl(1);
	OSERROR(connect(sfd, (struct sockaddr *)&sin6, 32),
		"connect");

	OSERROR(sendfile(sfd, dfd, NULL, 65536), "sendfile");
	return 0;
}