Commit 3ba3458f authored by Jakub Sitnicki's avatar Jakub Sitnicki Committed by David S. Miller

ipv6: Count in extension headers in skb->network_header

When sending a UDPv6 message longer than MTU, account for the length
of fragmentable IPv6 extension headers in skb->network_header offset.
Same as we do in alloc_new_skb path in __ip6_append_data().

This ensures that later on __ip6_make_skb() will make space in
headroom for fragmentable extension headers:

	/* move skb->data to ip header from ext header */
	if (skb->data < skb_network_header(skb))
		__skb_pull(skb, skb_network_offset(skb));

Prevents a splat due to skb_under_panic:

skbuff: skb_under_panic: text:ffffffff8143397b len:2126 put:14 \
head:ffff880005bacf50 data:ffff880005bacf4a tail:0x48 end:0xc0 dev:lo
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:104!
invalid opcode: 0000 [#1] KASAN
CPU: 0 PID: 160 Comm: reproducer Not tainted 4.6.0-rc2 #65
[...]
Call Trace:
 [<ffffffff813eb7b9>] skb_push+0x79/0x80
 [<ffffffff8143397b>] eth_header+0x2b/0x100
 [<ffffffff8141e0d0>] neigh_resolve_output+0x210/0x310
 [<ffffffff814eab77>] ip6_finish_output2+0x4a7/0x7c0
 [<ffffffff814efe3a>] ip6_output+0x16a/0x280
 [<ffffffff815440c1>] ip6_local_out+0xb1/0xf0
 [<ffffffff814f1115>] ip6_send_skb+0x45/0xd0
 [<ffffffff81518836>] udp_v6_send_skb+0x246/0x5d0
 [<ffffffff8151985e>] udpv6_sendmsg+0xa6e/0x1090
[...]
Reported-by: default avatarJi Jianwen <jiji@redhat.com>
Signed-off-by: default avatarJakub Sitnicki <jkbs@redhat.com>
Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 579ba855
...@@ -1090,8 +1090,8 @@ static inline int ip6_ufo_append_data(struct sock *sk, ...@@ -1090,8 +1090,8 @@ static inline int ip6_ufo_append_data(struct sock *sk,
int getfrag(void *from, char *to, int offset, int len, int getfrag(void *from, char *to, int offset, int len,
int odd, struct sk_buff *skb), int odd, struct sk_buff *skb),
void *from, int length, int hh_len, int fragheaderlen, void *from, int length, int hh_len, int fragheaderlen,
int transhdrlen, int mtu, unsigned int flags, int exthdrlen, int transhdrlen, int mtu,
const struct flowi6 *fl6) unsigned int flags, const struct flowi6 *fl6)
{ {
struct sk_buff *skb; struct sk_buff *skb;
...@@ -1116,7 +1116,7 @@ static inline int ip6_ufo_append_data(struct sock *sk, ...@@ -1116,7 +1116,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
skb_put(skb, fragheaderlen + transhdrlen); skb_put(skb, fragheaderlen + transhdrlen);
/* initialize network header pointer */ /* initialize network header pointer */
skb_reset_network_header(skb); skb_set_network_header(skb, exthdrlen);
/* initialize protocol header pointer */ /* initialize protocol header pointer */
skb->transport_header = skb->network_header + fragheaderlen; skb->transport_header = skb->network_header + fragheaderlen;
...@@ -1358,7 +1358,7 @@ static int __ip6_append_data(struct sock *sk, ...@@ -1358,7 +1358,7 @@ static int __ip6_append_data(struct sock *sk,
(rt->dst.dev->features & NETIF_F_UFO) && (rt->dst.dev->features & NETIF_F_UFO) &&
(sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) { (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
err = ip6_ufo_append_data(sk, queue, getfrag, from, length, err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
hh_len, fragheaderlen, hh_len, fragheaderlen, exthdrlen,
transhdrlen, mtu, flags, fl6); transhdrlen, mtu, flags, fl6);
if (err) if (err)
goto error; goto error;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment