* I found a strange place while reading “net/ipv6/reassembly.c”
@ 2018-08-15 4:38 Ttttabcd
2018-08-15 13:16 ` Sabrina Dubroca
0 siblings, 1 reply; 2+ messages in thread
From: Ttttabcd @ 2018-08-15 4:38 UTC (permalink / raw)
To: netdev
Hello everyone who develops the kernel.
At the beginning I was looking for the source author, but his email address has expired, so I can only come here to ask questions.
The problem is in the /net/ipv6/reassembly.c file, the author is Pedro Roque.
I found some strange places when I read the code for this file (Linux Kernel version 4.18).
In the "/net/ipv6/reassembly.c"
In the function "ip6_frag_queue"
offset = ntohs(fhdr->frag_off) & ~0x7;
end = offset + (ntohs(ipv6_hdr(skb)->payload_len) -
((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
if ((unsigned int)end > IPV6_MAXPLEN) {
*prob_offset = (u8 *)&fhdr->frag_off - skb_network_header(skb);
return -1;
}
Here the length of the payload is judged.
And in the function "ip6_frag_reasm"
payload_len = ((head->data - skb_network_header(head)) -
sizeof(struct ipv6hdr) + fq->q.len -
sizeof(struct frag_hdr));
if (payload_len > IPV6_MAXPLEN)
goto out_oversize;
......
out_oversize:
net_dbg_ratelimited("ip6_frag_reasm: payload len = %d\n", payload_len);
goto out_fail;
Here also judges the length of the payload.
Judged the payload length twice.
I tested that the code in the label "out_oversize:" does not execute at all, because it has been returned in "ip6_frag_queue".
Unless I comment out the code that judge the payload length in the function "ip6_frag_queue", the code labeled "out_oversize:" can be executed.
So, is this repeated?
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: I found a strange place while reading “net/ipv6/reassembly.c”
2018-08-15 4:38 I found a strange place while reading “net/ipv6/reassembly.c” Ttttabcd
@ 2018-08-15 13:16 ` Sabrina Dubroca
0 siblings, 0 replies; 2+ messages in thread
From: Sabrina Dubroca @ 2018-08-15 13:16 UTC (permalink / raw)
To: Ttttabcd; +Cc: netdev
2018-08-15, 04:38:29 +0000, Ttttabcd wrote:
> Hello everyone who develops the kernel.
>
> At the beginning I was looking for the source author, but his email
> address has expired, so I can only come here to ask questions.
>
> The problem is in the /net/ipv6/reassembly.c file, the author is
> Pedro Roque.
>
> I found some strange places when I read the code for this file
> (Linux Kernel version 4.18).
>
> In the "/net/ipv6/reassembly.c"
>
> In the function "ip6_frag_queue"
>
> offset = ntohs(fhdr->frag_off) & ~0x7;
> end = offset + (ntohs(ipv6_hdr(skb)->payload_len) -
> ((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
>
> if ((unsigned int)end > IPV6_MAXPLEN) {
> *prob_offset = (u8 *)&fhdr->frag_off - skb_network_header(skb);
> return -1;
> }
>
> Here the length of the payload is judged.
This check is based on the fragment currently being processed, and
only considers the reassembled payload.
> And in the function "ip6_frag_reasm"
>
Re-adding the comment that comes just above this:
/* Unfragmented part is taken from the first segment. */
> payload_len = ((head->data - skb_network_header(head)) -
> sizeof(struct ipv6hdr) + fq->q.len -
> sizeof(struct frag_hdr));
> if (payload_len > IPV6_MAXPLEN)
> goto out_oversize;
This considers the reassembled payload (ie, as above) *and* any
extension headers that might come before it.
> ......
> out_oversize:
> net_dbg_ratelimited("ip6_frag_reasm: payload len = %d\n", payload_len);
> goto out_fail;
>
> Here also judges the length of the payload.
>
> Judged the payload length twice.
>
> I tested that the code in the label "out_oversize:" does not execute
> at all, because it has been returned in "ip6_frag_queue".
If you try again with a routing header, I think you'll see it trigger.
> Unless I comment out the code that judge the payload length in the
> function "ip6_frag_queue", the code labeled "out_oversize:" can be
> executed.
>
> So, is this repeated?
--
Sabrina
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-08-15 16:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-08-15 4:38 I found a strange place while reading “net/ipv6/reassembly.c” Ttttabcd
2018-08-15 13:16 ` Sabrina Dubroca
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.