Commit 3a1cebe7 authored May 11, 2014 by Hannes Frederic Sowa Committed by David S. Miller May 14, 2014

ipv6: fix calculation of option len in ip6_append_data

tot_len does specify the size of struct ipv6_txoptions. We need opt_flen +
opt_nflen to calculate the overall length of additional ipv6 extensions.

I found this while auditing the ipv6 output path for a memory corruption
reported by Alexey Preobrazhensky while he fuzzed an instrumented
AddressSanitizer kernel with trinity. This may or may not be the cause
of the original bug.

Fixes: 4df98e76 ("ipv6: pmtudisc setting not respected with UFO/CORK")
Reported-by: Alexey Preobrazhensky <preobr@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 3d440522

net/ipv6/ip6_output.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1229,7 +1229,7 @@ int ip6_append_data(struct sock sk, int getfrag(void from, char *to,
	unsigned int maxnonfragsize, headersize;		unsigned int maxnonfragsize, headersize;

	headersize = sizeof(struct ipv6hdr) +		headersize = sizeof(struct ipv6hdr) +
	(opt ? opt->tot_len : 0) +		(opt ? opt->opt_flen + opt->opt_nflen : 0) +
	(dst_allfrag(&rt->dst) ?		(dst_allfrag(&rt->dst) ?
	sizeof(struct frag_hdr) : 0) +		sizeof(struct frag_hdr) : 0) +
	rt->rt6i_nfheader_len;		rt->rt6i_nfheader_len;