From: Dan Carpenter <dan.carpenter@oracle.com>
To: kbuild@01.org, hujunwei <hujunwei4@huawei.com>
Cc: kbuild-all@01.org, davem@davemloft.net, kuznet@ms2.inr.ac.ru,
yoshfuji@linux-ipv6.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, mingfangsen@huawei.com,
liuzhiqiang26@huawei.com, zhangwenhao8@huawei.com,
wangxiaogang3@huawei.com
Subject: Re: [PATCH v3 net] ipv6: Fix dangling pointer when ipv6 fragment
Date: Wed, 3 Apr 2019 08:01:09 +0300 [thread overview]
Message-ID: <20190403050109.GH32613@kadam> (raw)
In-Reply-To: <44e8dcf8-bf64-0407-65bb-122d0853c672@huawei.com>
Hi hujunwei,
url: https://github.com/0day-ci/linux/commits/hujunwei/ipv6-Fix-dangling-pointer-when-ipv6-fragment/20190402-175602
New smatch warnings:
net/ipv6/ip6_output.c:609 ip6_fragment() error: uninitialized symbol 'prevhdr'.
Old smatch warnings:
net/ipv6/ip6_output.c:247 ip6_xmit() error: we previously assumed 'np' could be null (see line 241)
# https://github.com/0day-ci/linux/commit/7f25fe5b3011737e52e4d8b4a2dfcafd46677115
git remote add linux-review https://github.com/0day-ci/linux
git remote update linux-review
git checkout 7f25fe5b3011737e52e4d8b4a2dfcafd46677115
vim +/prevhdr +609 net/ipv6/ip6_output.c
^1da177e4 Linus Torvalds 2005-04-16 594
7d8c6e391 Eric W. Biederman 2015-06-12 595 int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
7d8c6e391 Eric W. Biederman 2015-06-12 596 int (*output)(struct net *, struct sock *, struct sk_buff *))
^1da177e4 Linus Torvalds 2005-04-16 597 {
^1da177e4 Linus Torvalds 2005-04-16 598 struct sk_buff *frag;
adf30907d Eric Dumazet 2009-06-02 599 struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
f60e5990d hannes@stressinduktion.org 2015-04-01 600 struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
f60e5990d hannes@stressinduktion.org 2015-04-01 601 inet6_sk(skb->sk) : NULL;
^1da177e4 Linus Torvalds 2005-04-16 602 struct ipv6hdr *tmp_hdr;
^1da177e4 Linus Torvalds 2005-04-16 603 struct frag_hdr *fh;
7f25fe5b3 Junwei Hu 2019-04-02 604 unsigned int mtu, hlen, left, len, nexthdr_offset;
a7ae19922 Herbert Xu 2011-11-18 605 int hroom, troom;
286c2349f Martin KaFai Lau 2015-05-22 606 __be32 frag_id;
^1da177e4 Linus Torvalds 2005-04-16 607 int ptr, offset = 0, err = 0;
^1da177e4 Linus Torvalds 2005-04-16 608 u8 *prevhdr, nexthdr = 0;
^^^^^^^^
7f25fe5b3 Junwei Hu 2019-04-02 @609 nexthdr_offset = prevhdr - skb_network_header(skb);
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^1da177e4 Linus Torvalds 2005-04-16 610
7dd7eb951 David S. Miller 2017-05-17 611 err = ip6_find_1stfragopt(skb, &prevhdr);
^^^^^^^^
7dd7eb951 David S. Miller 2017-05-17 612 if (err < 0)
2423496af Craig Gallek 2017-05-16 613 goto fail;
7dd7eb951 David S. Miller 2017-05-17 614 hlen = err;
^1da177e4 Linus Torvalds 2005-04-16 615 nexthdr = *prevhdr;
^1da177e4 Linus Torvalds 2005-04-16 616
628a5c561 John Heffner 2007-04-20 617 mtu = ip6_skb_dst_mtu(skb);
b881ef760 John Heffner 2007-04-20 618
b881ef760 John Heffner 2007-04-20 619 /* We must not fragment if the socket is set to force MTU discovery
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
next prev parent reply other threads:[~2019-04-03 5:06 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-02 3:09 [PATCH v3 net] ipv6: Fix dangling pointer when ipv6 fragment hujunwei
2019-04-02 10:49 ` kbuild test robot
2019-04-02 15:34 ` Martin Lau
2019-04-03 1:32 ` hujunwei
2019-04-03 5:01 ` Dan Carpenter [this message]
2019-04-03 6:47 ` hujunwei
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190403050109.GH32613@kadam \
--to=dan.carpenter@oracle.com \
--cc=davem@davemloft.net \
--cc=hujunwei4@huawei.com \
--cc=kbuild-all@01.org \
--cc=kbuild@01.org \
--cc=kuznet@ms2.inr.ac.ru \
--cc=linux-kernel@vger.kernel.org \
--cc=liuzhiqiang26@huawei.com \
--cc=mingfangsen@huawei.com \
--cc=netdev@vger.kernel.org \
--cc=wangxiaogang3@huawei.com \
--cc=yoshfuji@linux-ipv6.org \
--cc=zhangwenhao8@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).