Re: [PATCH net v3 2/2] ipv6: account for fraggap on the paged allocation path

[Ido Schimmel <idosch@nvidia.com>]

On Thu, Jun 11, 2026 at 10:34:13PM +0900, Wongi Lee wrote:
> In __ip6_append_data(), when the paged-allocation branch is taken
> (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
> computed as
> 
> 	alloclen = fragheaderlen + transhdrlen;
> 	pagedlen = datalen - transhdrlen;
> 
> datalen already includes fraggap (datalen = length + fraggap), but
> the fraggap bytes carried over from the previous skb are copied into
> the new skb's linear area at offset transhdrlen by the subsequent
> skb_copy_and_csum_bits(). The linear area is therefore undersized by
> fraggap bytes while pagedlen is overstated by the same amount, and
> the copy writes past skb->end into the trailing skb_shared_info.

Nit: I agree with the conclusion that the linear area is undersized, but
"copied into the new skb's linear area at offset transhdrlen" is not
accurate:

If fraggap is non-zero, this means that this is not the first skb and
that the transport header length is zero. We copy the gap bytes just
past the fragment headers:

data = skb_put(...);
data += fragheaderlen;
skb_copy_and_csum_bits(..., data + transhdrlen, fraggap) =
skb_copy_and_csum_bits(..., data + 0, fraggap)

> 
> An unprivileged user can trigger this via a UDPv6 socket using
> MSG_MORE together with MSG_SPLICE_PAGES.
> 
> The bad accounting was introduced by commit 773ba4fe9104 ("ipv6:
> avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix
> __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative
> copy value caused -EINVAL to be returned. That later commit allowed
> MSG_SPLICE_PAGES to proceed in this case, making the corruption
> triggerable.
> 
> The non-paged branch sets alloclen to fraglen, which already accounts
> for fraggap because datalen does. Bring the paged branch in line by
> adding fraggap to alloclen and subtracting it from pagedlen.
> 
> After this adjustment, copy no longer collapses to -fraggap on the
> paged path, so remove the stale comment describing that old arithmetic.
> 
> Fixes: 773ba4fe9104 ("ipv6: avoid partial copy for zc")
> Signed-off-by: Jungwoo Lee <jwlee2217@gmail.com>
> Signed-off-by: Wongi Lee <qw3rtyp0@gmail.com>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>