lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20190403050109.GH32613@kadam> Date: Wed, 3 Apr 2019 08:01:09 +0300 From: Dan Carpenter <dan.carpenter@...cle.com> To: kbuild@...org, hujunwei <hujunwei4@...wei.com> Cc: kbuild-all@...org, davem@...emloft.net, kuznet@....inr.ac.ru, yoshfuji@...ux-ipv6.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, mingfangsen@...wei.com, liuzhiqiang26@...wei.com, zhangwenhao8@...wei.com, wangxiaogang3@...wei.com Subject: Re: [PATCH v3 net] ipv6: Fix dangling pointer when ipv6 fragment Hi hujunwei, url: https://github.com/0day-ci/linux/commits/hujunwei/ipv6-Fix-dangling-pointer-when-ipv6-fragment/20190402-175602 New smatch warnings: net/ipv6/ip6_output.c:609 ip6_fragment() error: uninitialized symbol 'prevhdr'. Old smatch warnings: net/ipv6/ip6_output.c:247 ip6_xmit() error: we previously assumed 'np' could be null (see line 241) # https://github.com/0day-ci/linux/commit/7f25fe5b3011737e52e4d8b4a2dfcafd46677115 git remote add linux-review https://github.com/0day-ci/linux git remote update linux-review git checkout 7f25fe5b3011737e52e4d8b4a2dfcafd46677115 vim +/prevhdr +609 net/ipv6/ip6_output.c ^1da177e4 Linus Torvalds 2005-04-16 594 7d8c6e391 Eric W. Biederman 2015-06-12 595 int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, 7d8c6e391 Eric W. Biederman 2015-06-12 596 int (*output)(struct net *, struct sock *, struct sk_buff *)) ^1da177e4 Linus Torvalds 2005-04-16 597 { ^1da177e4 Linus Torvalds 2005-04-16 598 struct sk_buff *frag; adf30907d Eric Dumazet 2009-06-02 599 struct rt6_info *rt = (struct rt6_info *)skb_dst(skb); f60e5990d hannes@...essinduktion.org 2015-04-01 600 struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ? f60e5990d hannes@...essinduktion.org 2015-04-01 601 inet6_sk(skb->sk) : NULL; ^1da177e4 Linus Torvalds 2005-04-16 602 struct ipv6hdr *tmp_hdr; ^1da177e4 Linus Torvalds 2005-04-16 603 struct frag_hdr *fh; 7f25fe5b3 Junwei Hu 2019-04-02 604 unsigned int mtu, hlen, left, len, nexthdr_offset; a7ae19922 Herbert Xu 2011-11-18 605 int hroom, troom; 286c2349f Martin KaFai Lau 2015-05-22 606 __be32 frag_id; ^1da177e4 Linus Torvalds 2005-04-16 607 int ptr, offset = 0, err = 0; ^1da177e4 Linus Torvalds 2005-04-16 608 u8 *prevhdr, nexthdr = 0; ^^^^^^^^ 7f25fe5b3 Junwei Hu 2019-04-02 @609 nexthdr_offset = prevhdr - skb_network_header(skb); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^1da177e4 Linus Torvalds 2005-04-16 610 7dd7eb951 David S. Miller 2017-05-17 611 err = ip6_find_1stfragopt(skb, &prevhdr); ^^^^^^^^ 7dd7eb951 David S. Miller 2017-05-17 612 if (err < 0) 2423496af Craig Gallek 2017-05-16 613 goto fail; 7dd7eb951 David S. Miller 2017-05-17 614 hlen = err; ^1da177e4 Linus Torvalds 2005-04-16 615 nexthdr = *prevhdr; ^1da177e4 Linus Torvalds 2005-04-16 616 628a5c561 John Heffner 2007-04-20 617 mtu = ip6_skb_dst_mtu(skb); b881ef760 John Heffner 2007-04-20 618 b881ef760 John Heffner 2007-04-20 619 /* We must not fragment if the socket is set to force MTU discovery --- 0-DAY kernel test infrastructure Open Source Technology Center https://lists.01.org/pipermail/kbuild-all Intel Corporation
Powered by blists - more mailing lists