Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) client-ip=2620:137:e000::3:5;
Date:   Tue, 19 Sep 2023 09:27:13 +0100
From:   Tom Parkin <tparkin@katalix.com>
To:     Eric Dumazet <edumazet@google.com>
Cc:     Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
        David Howells <dhowells@redhat.com>,
        syzbot <syzbot+62cbf263225ae13ff153@syzkaller.appspotmail.com>,
        bpf@vger.kernel.org, davem@davemloft.net, dsahern@kernel.org,
        kuba@kernel.org, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org, pabeni@redhat.com,
        syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [net?] WARNING in __ip6_append_data
Message-ID: <ZQlbYVCjCyuPotdX@katalix.com>
References: <3793723.1694795079@warthog.procyon.org.uk>
 <CANn89iLwMhOnrmQTZJ+BqZJSbJZ+Q4W6xRknAAr+uSrk5TX-EQ@mail.gmail.com>
 <0000000000001c12b30605378ce8@google.com>
 <3905046.1695031382@warthog.procyon.org.uk>
 <65085768c17da_898cd294ae@willemb.c.googlers.com.notmuch>
 <CANn89iJ39Hguu6bRm2am6J_u0pSnm++ORa_UVpC0+8-mxORFfw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="qe7qz294sxBAXLZG"
Content-Disposition: inline
In-Reply-To: <CANn89iJ39Hguu6bRm2am6J_u0pSnm++ORa_UVpC0+8-mxORFfw@mail.gmail.com>
Precedence: bulk


--qe7qz294sxBAXLZG
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On  Mon, Sep 18, 2023 at 16:04:49 +0200, Eric Dumazet wrote:
> On Mon, Sep 18, 2023 at 3:58=E2=80=AFPM Willem de Bruijn
> <willemdebruijn.kernel@gmail.com> wrote:
> >
> > David Howells wrote:
> > > David Howells <dhowells@redhat.com> wrote:
> > >
> > > > I think the attached is probably an equivalent cleaned up reproduce=
r.  Note
> > > > that if the length given to sendfile() is less than 65536, it fails=
 with
> > > > EINVAL before it gets into __ip6_append_data().
> > >
> > > Actually, it only fails with EINVAL if the size is not a multiple of =
the block
> > > size of the source file because it's open O_DIRECT so, say, 65536-512=
 is fine
> > > (and works).
> > >
> > > But thinking more on this further, is this even a bug in my code, I w=
onder?
> > > The length passed is 65536 - but a UDP packet can't carry that, so it
> > > shouldn't it have errored out before getting that far?  (which is wha=
t it
> > > seems to do when I try it).
> > >
> > > I don't see how we get past the length check in ip6_append_data() wit=
h the
> > > reproducer we're given unless the MTU is somewhat bigger than 65536 (=
is that
> > > even possible?)
> >
> > An ipv6 packet can carry 64KB of payload, so maxnonfragsize of 65535 + =
40
> > sounds correct. But payload length passed of 65536 is not (ignoring ipv6
> > jumbograms). So that should probably trigger an EINVAL -- if that is in=
deed
> > what the repro does.
>=20
> l2tp_ip6_sendmsg() claims ip6_append_data() can make better checks,
> but what about simply replacing INT_MAX by 65535 ?

Slightly OT but I think the l2tp_ip6.c approach was probably cribbed
=66rom net/ipv6/udp.c's udpv6_sendmsg originally:


    /* Rough check on arithmetic overflow,
       better check is made in ip6_append_data().
       */
    if (len > INT_MAX - sizeof(struct udphdr))
        return -EMSGSIZE;


Should the udp code be modified similarly?

--=20
Tom Parkin
Katalix Systems Ltd
https://katalix.com
Catalysts for your Embedded Linux software development

--qe7qz294sxBAXLZG
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEEsUkgyDzMwrj81nq0lIwGZQq6i9AFAmUJW1sACgkQlIwGZQq6
i9CDhwf8Dr9xdA/kYI0P1TS6do/S0cMJsdoybHmEfhErfoA5n20det6rz7EvsxLn
qkiFW3urMCSMAsB6wuftENVni4tswHbpWjuQ890o8BfmW/fBL7avioZd6qESgykx
X4WGGkDLeRnlOZb5jhzqVKsinxmhDQQL/Iogq18z/VWZwC6od+k61RIIIwdpgik8
foGPo6aJ3a43pAJ7Cl8AeAAySHHJ+0nZPlh7ns49bcBWfDa9y05hVddXAcNSOExL
LVt2Atkm1BIXGR7eSB9dIb5clb9WRWT1hqFfuE6N6DkYyqmRWkbEdsLvntWm5CcD
UC+ZbLZlslafOuG+BLDrAXiWcL3wRw==
=X+72
-----END PGP SIGNATURE-----

--qe7qz294sxBAXLZG--