| From foo@baz Wed May 28 21:03:54 PDT 2014 |
| From: Hannes Frederic Sowa <hannes@stressinduktion.org> |
| Date: Sun, 11 May 2014 23:01:13 +0200 |
| Subject: ipv6: fix calculation of option len in ip6_append_data |
| |
| From: Hannes Frederic Sowa <hannes@stressinduktion.org> |
| |
| [ Upstream commit 3a1cebe7e05027a1c96f2fc1a8eddf5f19b78f42 ] |
| |
| tot_len does specify the size of struct ipv6_txoptions. We need opt_flen + |
| opt_nflen to calculate the overall length of additional ipv6 extensions. |
| |
| I found this while auditing the ipv6 output path for a memory corruption |
| reported by Alexey Preobrazhensky while he fuzzed an instrumented |
| AddressSanitizer kernel with trinity. This may or may not be the cause |
| of the original bug. |
| |
| Fixes: 4df98e76cde7c6 ("ipv6: pmtudisc setting not respected with UFO/CORK") |
| Reported-by: Alexey Preobrazhensky <preobr@google.com> |
| Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/ipv6/ip6_output.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/ipv6/ip6_output.c |
| +++ b/net/ipv6/ip6_output.c |
| @@ -1229,7 +1229,7 @@ int ip6_append_data(struct sock *sk, int |
| unsigned int maxnonfragsize, headersize; |
| |
| headersize = sizeof(struct ipv6hdr) + |
| - (opt ? opt->tot_len : 0) + |
| + (opt ? opt->opt_flen + opt->opt_nflen : 0) + |
| (dst_allfrag(&rt->dst) ? |
| sizeof(struct frag_hdr) : 0) + |
| rt->rt6i_nfheader_len; |
