From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Dumazet <eric.dumazet@gmail.com>
Subject: Re: [PATCH net] ipv6: fix udpv6 sendmsg crash caused by too small
 MTU
Date: Wed, 10 Jan 2018 10:56:47 -0800
Message-ID: <1515610607.131759.27.camel@gmail.com>
References: <20180110174510.138752-1-maloneykernel@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Cc: Mike Maloney <maloney@google.com>
To: Mike Maloney <maloneykernel@gmail.com>, netdev@vger.kernel.org,
        davem@davemloft.net
Return-path: <netdev-owner@vger.kernel.org>
Received: from mail-pg0-f51.google.com ([74.125.83.51]:38187 "EHLO
        mail-pg0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751607AbeAJS4u (ORCPT
        <rfc822;netdev@vger.kernel.org>); Wed, 10 Jan 2018 13:56:50 -0500
Received: by mail-pg0-f51.google.com with SMTP id t67so10615pgc.5
        for <netdev@vger.kernel.org>; Wed, 10 Jan 2018 10:56:50 -0800 (PST)
In-Reply-To: <20180110174510.138752-1-maloneykernel@gmail.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

On Wed, 2018-01-10 at 12:45 -0500, Mike Maloney wrote:
> From: Mike Maloney <maloney@google.com>
> 
> The logic in __ip6_append_data() assumes that the MTU is at least large
> enough for the headers.  A device's MTU may be adjusted after being
> added while sendmsg() is processing data, resulting in
> __ip6_append_data() seeing any MTU.  For an mtu smaller than the size of
> the fragmentation header, the math results in a negative 'maxfraglen',
> which causes problems when refragmenting any previous skb in the
> skb_write_queue, leaving it possibly malformed.
> 
> Instead sendmsg returns EINVAL when the mtu is calculated to be less
> than IPV6_MIN_MTU.
> 

> Reported-by: syzbot <syzkaller@googlegroups.com>
> Signed-off-by: Mike Maloney <maloney@google.com>
> 
> 

Reviewed-by: Eric Dumazet <edumazet@google.com>