Willem de Bruijn <willemdebruijn.kernel@xxxxxxxxx> wrote: > > An ipv6 packet can carry 64KB of payload, so maxnonfragsize of 65535 + 40 > sounds correct. But payload length passed of 65536 is not (ignoring ipv6 > jumbograms). So that should probably trigger an EINVAL -- if that is indeed > what the repro does. The problem is that on entry to __ip6_append_data(), the length includes transhdrlen. However, this is a problem if we already have something in the packet. At that point, this fails: if (WARN_ON_ONCE(copy > msg->msg_iter.count)) goto error; because copy includes transhdrlen. David
