On Thu, Mar 10, 2022 at 6:26 PM Tadeusz Struk <tadeusz.struk@xxxxxxxxxx> wrote: > > Syzbot found a kernel bug in the ipv6 stack: > LINK: https://syzkaller.appspot.com/bug?id=205d6f11d72329ab8d62a610c44c5e7e25415580 > The reproducer triggers it by sending a crafted message via sendmmsg() > call, which triggers skb_over_panic, and crashes the kernel: > > skbuff: skb_over_panic: text:ffffffff84647fb4 len:65575 put:65575 > head:ffff888109ff0000 data:ffff888109ff0088 tail:0x100af end:0xfec0 > dev:<NULL> > > Update the check that prevents an invalid packet with MTU equall to the > fregment header size to eat up all the space for payload. > > The reproducer can be found here: > LINK: https://syzkaller.appspot.com/text?tag=ReproC&x=1648c83fb00000 > > Cc: Willem de Bruijn <willemdebruijn.kernel@xxxxxxxxx> > Cc: David S. Miller <davem@xxxxxxxxxxxxx> > Cc: Hideaki YOSHIFUJI <yoshfuji@xxxxxxxxxxxxxx> > Cc: David Ahern <dsahern@xxxxxxxxxx> > Cc: Jakub Kicinski <kuba@xxxxxxxxxx> > Cc: Alexei Starovoitov <ast@xxxxxxxxxx> > Cc: Daniel Borkmann <daniel@xxxxxxxxxxxxx> > Cc: Andrii Nakryiko <andrii@xxxxxxxxxx> > Cc: Martin KaFai Lau <kafai@xxxxxx> > Cc: Song Liu <songliubraving@xxxxxx> > Cc: Yonghong Song <yhs@xxxxxx> > Cc: John Fastabend <john.fastabend@xxxxxxxxx> > Cc: KP Singh <kpsingh@xxxxxxxxxx> > Cc: netdev@xxxxxxxxxxxxxxx > Cc: bpf@xxxxxxxxxxxxxxx > Cc: linux-kernel@xxxxxxxxxxxxxxx > Cc: stable@xxxxxxxxxxxxxxx > > Reported-by: syzbot+e223cf47ec8ae183f2a0@xxxxxxxxxxxxxxxxxxxxxxxxx > Signed-off-by: Tadeusz Struk <tadeusz.struk@xxxxxxxxxx> Acked-by: Willem de Bruijn <willemb@xxxxxxxxxx> small nit: "equal to the fragment" and all these Cc:s aren't really needed in the commit message. I don't think we'll find a commit for a Fixes tag. This goes ways back.
