From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32DF2C5479D for ; Mon, 9 Jan 2023 10:07:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236690AbjAIKHU (ORCPT ); Mon, 9 Jan 2023 05:07:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53742 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234238AbjAIKGq (ORCPT ); Mon, 9 Jan 2023 05:06:46 -0500 Received: from formenos.hmeau.com (helcar.hmeau.com [216.24.177.18]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 42CACB6F for ; Mon, 9 Jan 2023 02:05:21 -0800 (PST) Received: from loth.rohan.me.apana.org.au ([192.168.167.2]) by formenos.hmeau.com with smtp (Exim 4.94.2 #2 (Debian)) id 1pEp1f-00FYox-C1; Mon, 09 Jan 2023 18:05:08 +0800 Received: by loth.rohan.me.apana.org.au (sSMTP sendmail emulation); Mon, 09 Jan 2023 18:05:07 +0800 Date: Mon, 9 Jan 2023 18:05:07 +0800 From: Herbert Xu To: Eric Dumazet Cc: Kyle Zeng , Jakub Kicinski , davem@davemloft.net, yoshfuji@linux-ipv6.org, dsahern@kernel.org, pabeni@redhat.com, netdev@vger.kernel.org Subject: Re: net: ipv6: raw: fixes null pointer deference in rawv6_push_pending_frames Message-ID: References: <20230106145553.6dd014f1@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Mon, Jan 09, 2023 at 09:45:14AM +0100, Eric Dumazet wrote: > > OK, but it seems we would be in an error condition, and would need to > purge sk_write_queue ? No the bug is elsewhere. We already checked whether the offset is valid at the top of the function: total_len = inet_sk(sk)->cork.base.length; if (offset >= total_len - 1) { err = -EINVAL; ip6_flush_pending_frames(sk); goto out; } So we should figure out why the socket cork queue contains less data than it claims. Do we have a reproducer? Thanks, -- Email: Herbert Xu Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt