Commit b72a2b01 authored Oct 16, 2015 by Hannes Frederic Sowa Committed by David S. Miller Oct 23, 2015

ipv6: protect mtu calculation of wrap-around and infinite loop by rounding issues



Raw sockets with hdrincl enabled can insert ipv6 extension headers
right into the data stream. In case we need to fragment those packets,
we reparse the options header to find the place where we can insert
the fragment header. If the extension headers exceed the link's MTU we
actually cannot make progress in such a case.

Instead of ending up in broken arithmetic or rounding towards 0 and
entering an endless loop in ip6_fragment, just prevent those cases by
aborting early and signal -EMSGSIZE to user space.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 79907146

net/ipv6/ip6_output.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -28,6 +28,7 @@

		#include <linux/errno.h>
		#include <linux/kernel.h>
		#include <linux/overflow-arith.h>
		#include <linux/string.h>
		#include <linux/socket.h>
		#include <linux/net.h>
		@@ -584,7 +585,10 @@ int ip6_fragment(struct sock sk, struct sk_buff skb,
		if (np->frag_size)
		mtu = np->frag_size;
		}
		mtu -= hlen + sizeof(struct frag_hdr);

		if (overflow_usub(mtu, hlen + sizeof(struct frag_hdr), &mtu) \|\|
		mtu <= 7)
		goto fail_toobig;

		frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
		&ipv6_hdr(skb)->saddr);

Admin message