ipv6: Fix dangling pointer when ipv6 fragment (ef0efcd3) · Commits · 戴 / test

At the beginning of ip6_fragment func, the prevhdr pointer is obtained in the ip6_find_1stfragopt func. However, all the pointers pointing into skb header may change when calling skb_checksum_help func with skb->ip_summed = CHECKSUM_PARTIAL condition. The prevhdr pointe will be dangling if it is not reloaded after calling __skb_linearize func in skb_checksum_help func. Here, I add a variable, nexthdr_offset, to evaluate the offset, which does not changes even after calling __skb_linearize func. Fixes: ("ipv6: add defensive check for CHECKSUM_PARTIAL skbs in ip_fragment") Signed-off-by:

Junwei Hu <hujunwei4@huawei.com> Reported-by:

Wenhao Zhang <zhangwenhao8@huawei.com> Reported-by:

<syzbot+e8ce541d095e486074fc@syzkaller.appspotmail.com> Reviewed-by:

Zhiqiang Liu <liuzhiqiang26@huawei.com> Acked-by:

Martin KaFai Lau <kafai@fb.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv6/ip6_output.c

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -601,7 +601,7 @@ int ip6_fragment(struct net net, struct sock sk, struct sk_buff *skb,
	inet6_sk(skb->sk) : NULL;		inet6_sk(skb->sk) : NULL;
	struct ipv6hdr *tmp_hdr;		struct ipv6hdr *tmp_hdr;
	struct frag_hdr *fh;		struct frag_hdr *fh;
	unsigned int mtu, hlen, left, len;		unsigned int mtu, hlen, left, len, nexthdr_offset;
	int hroom, troom;		int hroom, troom;
	__be32 frag_id;		__be32 frag_id;
	int ptr, offset = 0, err = 0;		int ptr, offset = 0, err = 0;
	@@ -612,6 +612,7 @@ int ip6_fragment(struct net net, struct sock sk, struct sk_buff *skb,
	goto fail;		goto fail;
	hlen = err;		hlen = err;
	nexthdr = *prevhdr;		nexthdr = *prevhdr;
			nexthdr_offset = prevhdr - skb_network_header(skb);

	mtu = ip6_skb_dst_mtu(skb);		mtu = ip6_skb_dst_mtu(skb);

	@@ -646,6 +647,7 @@ int ip6_fragment(struct net net, struct sock sk, struct sk_buff *skb,
	(err = skb_checksum_help(skb)))		(err = skb_checksum_help(skb)))
	goto fail;		goto fail;

			prevhdr = skb_network_header(skb) + nexthdr_offset;
	hroom = LL_RESERVED_SPACE(rt->dst.dev);		hroom = LL_RESERVED_SPACE(rt->dst.dev);
	if (skb_has_frag_list(skb)) {		if (skb_has_frag_list(skb)) {
	unsigned int first_len = skb_pagelen(skb);		unsigned int first_len = skb_pagelen(skb);

Admin message