[PATCH net] ipv6: fix calculation of option len in ip6_append_data

[PATCH net] ipv6: fix calculation of option len in ip6_append_data

[Hannes Frederic Sowa]

tot_len does specify the size of struct ipv6_txoptions. We need opt_flen +
opt_nflen to calculate the overall length of additional ipv6 extensions.

I found this while auditing the ipv6 output path for a memory corruption
reported by Alexey Preobrazhensky while he fuzzed an instrumented
AddressSanitizer kernel with trinity. This may or may not be the cause
of the original bug.

Fixes: 4df98e76cde7c6 ("ipv6: pmtudisc setting not respected with UFO/CORK")
Reported-by: Alexey Preobrazhensky <preobr@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
---
Also material for stable, thanks!

 net/ipv6/ip6_output.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 31a38bd..fbf1156 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1229,7 +1229,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
 		unsigned int maxnonfragsize, headersize;
 
 		headersize = sizeof(struct ipv6hdr) +
-			     (opt ? opt->tot_len : 0) +
+			     (opt ? opt->opt_flen + opt->opt_nflen : 0) +
 			     (dst_allfrag(&rt->dst) ?
 			      sizeof(struct frag_hdr) : 0) +
 			     rt->rt6i_nfheader_len;
-- 
1.9.0

Re: [PATCH net] ipv6: fix calculation of option len in ip6_append_data

[David Miller]

From: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date: Sun, 11 May 2014 23:01:13 +0200

> tot_len does specify the size of struct ipv6_txoptions. We need opt_flen +
> opt_nflen to calculate the overall length of additional ipv6 extensions.
> 
> I found this while auditing the ipv6 output path for a memory corruption
> reported by Alexey Preobrazhensky while he fuzzed an instrumented
> AddressSanitizer kernel with trinity. This may or may not be the cause
> of the original bug.
> 
> Fixes: 4df98e76cde7c6 ("ipv6: pmtudisc setting not respected with UFO/CORK")
> Reported-by: Alexey Preobrazhensky <preobr@google.com>
> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>

Applied and queued up for -stable, thanks!