Re: [PATCH v3 net] ipv6: Fix dangling pointer when ipv6 fragment
From: hujunwei
Date: Wed Apr 03 2019 - 02:52:27 EST
On 2019/4/3 13:01, Dan Carpenter wrote:
> Hi hujunwei,
>
> url: https://github.com/0day-ci/linux/commits/hujunwei/ipv6-Fix-dangling-pointer-when-ipv6-fragment/20190402-175602
>
> New smatch warnings:
> net/ipv6/ip6_output.c:609 ip6_fragment() error: uninitialized symbol 'prevhdr'.
>
> Old smatch warnings:
> net/ipv6/ip6_output.c:247 ip6_xmit() error: we previously assumed 'np' could be null (see line 241)
>
> # https://github.com/0day-ci/linux/commit/7f25fe5b3011737e52e4d8b4a2dfcafd46677115
> git remote add linux-review https://github.com/0day-ci/linux
> git remote update linux-review
> git checkout 7f25fe5b3011737e52e4d8b4a2dfcafd46677115
> vim +/prevhdr +609 net/ipv6/ip6_output.c
>
> ^1da177e4 Linus Torvalds 2005-04-16 594
> 7d8c6e391 Eric W. Biederman 2015-06-12 595 int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
> 7d8c6e391 Eric W. Biederman 2015-06-12 596 int (*output)(struct net *, struct sock *, struct sk_buff *))
> ^1da177e4 Linus Torvalds 2005-04-16 597 {
> ^1da177e4 Linus Torvalds 2005-04-16 598 struct sk_buff *frag;
> adf30907d Eric Dumazet 2009-06-02 599 struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
> f60e5990d hannes@xxxxxxxxxxxxxxxxxxx 2015-04-01 600 struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
> f60e5990d hannes@xxxxxxxxxxxxxxxxxxx 2015-04-01 601 inet6_sk(skb->sk) : NULL;
> ^1da177e4 Linus Torvalds 2005-04-16 602 struct ipv6hdr *tmp_hdr;
> ^1da177e4 Linus Torvalds 2005-04-16 603 struct frag_hdr *fh;
> 7f25fe5b3 Junwei Hu 2019-04-02 604 unsigned int mtu, hlen, left, len, nexthdr_offset;
> a7ae19922 Herbert Xu 2011-11-18 605 int hroom, troom;
> 286c2349f Martin KaFai Lau 2015-05-22 606 __be32 frag_id;
> ^1da177e4 Linus Torvalds 2005-04-16 607 int ptr, offset = 0, err = 0;
> ^1da177e4 Linus Torvalds 2005-04-16 608 u8 *prevhdr, nexthdr = 0;
> ^^^^^^^^
> 7f25fe5b3 Junwei Hu 2019-04-02 @609 nexthdr_offset = prevhdr - skb_network_header(skb);
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> ---
> 0-DAY kernel test infrastructure Open Source Technology Center
> https://lists.01.org/pipermail/kbuild-all Intel Corporation
>
> .
>
Hi Dan,
Thank you for your remind, I sorry for this, i send the patch v4 yesterday. You can get it from the mail list.