Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) client-ip=23.128.96.32;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <65085768c17da_898cd294ae@willemb.c.googlers.com.notmuch>
References: <65085768c17da_898cd294ae@willemb.c.googlers.com.notmuch> <3793723.1694795079@warthog.procyon.org.uk> <CANn89iLwMhOnrmQTZJ+BqZJSbJZ+Q4W6xRknAAr+uSrk5TX-EQ@mail.gmail.com> <0000000000001c12b30605378ce8@google.com> <3905046.1695031382@warthog.procyon.org.uk>
To:     Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Cc:     dhowells@redhat.com, Eric Dumazet <edumazet@google.com>,
        syzbot <syzbot+62cbf263225ae13ff153@syzkaller.appspotmail.com>,
        bpf@vger.kernel.org, davem@davemloft.net, dsahern@kernel.org,
        kuba@kernel.org, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org, pabeni@redhat.com,
        syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [net?] WARNING in __ip6_append_data
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <4138873.1695048373.1@warthog.procyon.org.uk>
Date:   Mon, 18 Sep 2023 15:46:13 +0100
Message-ID: <4138874.1695048373@warthog.procyon.org.uk>
Precedence: bulk

Willem de Bruijn <willemdebruijn.kernel@gmail.com> wrote:

> 
> An ipv6 packet can carry 64KB of payload, so maxnonfragsize of 65535 + 40
> sounds correct. But payload length passed of 65536 is not (ignoring ipv6
> jumbograms). So that should probably trigger an EINVAL -- if that is indeed
> what the repro does.

The problem is that on entry to __ip6_append_data(), the length includes
transhdrlen.  However, this is a problem if we already have something in the
packet.  At that point, this fails:

			if (WARN_ON_ONCE(copy > msg->msg_iter.count))
				goto error;

because copy includes transhdrlen.

David