linux-kernel - Re: [PATCH v3 net] ipv6: Fix dangling pointer when ipv6 fragment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e86af888-a0aa-f725-2f1b-6eeee1c779a3@huawei.com>
Date:   Wed, 3 Apr 2019 09:32:54 +0800
From:   hujunwei <hujunwei4@...wei.com>
To:     Martin Lau <kafai@...com>
CC:     "davem@...emloft.net" <davem@...emloft.net>,
        "kuznet@....inr.ac.ru" <kuznet@....inr.ac.ru>,
        "yoshfuji@...ux-ipv6.org" <yoshfuji@...ux-ipv6.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        <mingfangsen@...wei.com>, <liuzhiqiang26@...wei.com>
Subject: Re: [PATCH v3 net] ipv6: Fix dangling pointer when ipv6 fragment



On 2019/4/2 23:34, Martin Lau wrote:
> On Tue, Apr 02, 2019 at 06:49:03PM +0800, kbuild test robot wrote:
>> Hi hujunwei,
>>
>> Thank you for the patch! Perhaps something to improve:
>>
>> [auto build test WARNING on net/master]
>>
>>
>> vim +/prevhdr +609 net//ipv6/ip6_output.c
>>
>>    594	
>>    595	int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
>>    596			 int (*output)(struct net *, struct sock *, struct sk_buff *))
>>    597	{
>>    598		struct sk_buff *frag;
>>    599		struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
>>    600		struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
>>    601					inet6_sk(skb->sk) : NULL;
>>    602		struct ipv6hdr *tmp_hdr;
>>    603		struct frag_hdr *fh;
>>    604		unsigned int mtu, hlen, left, len, nexthdr_offset;
>>    605		int hroom, troom;
>>    606		__be32 frag_id;
>>    607		int ptr, offset = 0, err = 0;
>>    608		u8 *prevhdr, nexthdr = 0;
>>  > 609		nexthdr_offset = prevhdr - skb_network_header(skb);
> hmm... This line has been moved up since v2. :(

Hi Martin,
Thank you for your remind, I sorry for this, i send the patch v4 yesterday.