Wang Yufen 84dc940890 ipv6: Fix signed integer overflow in __ip6_append_data ... [ Upstream commit f93431c86b ] Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t. UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19 2147479552 + 8567 cannot be represented in type 'int' CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x214/0x230 show_stack+0x30/0x78 dump_stack_lvl+0xf8/0x118 dump_stack+0x18/0x30 ubsan_epilogue+0x18/0x60 handle_overflow+0xd0/0xf0 __ubsan_handle_add_overflow+0x34/0x44 __ip6_append_data.isra.48+0x1598/0x1688 ip6_append_data+0x128/0x260 udpv6_sendmsg+0x680/0xdd0 inet6_sendmsg+0x54/0x90 sock_sendmsg+0x70/0x88 ____sys_sendmsg+0xe8/0x368 ___sys_sendmsg+0x98/0xe0 __sys_sendmmsg+0xf4/0x3b8 __arm64_sys_sendmmsg+0x34/0x48 invoke_syscall+0x64/0x160 el0_svc_common.constprop.4+0x124/0x300 do_el0_svc+0x44/0xc8 el0_svc+0x3c/0x1e8 el0t_64_sync_handler+0x88/0xb0 el0t_64_sync+0x16c/0x170 Changes since v1: -Change the variable [length] type to unsigned, as Eric Dumazet suggested. Changes since v2: -Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested. Changes since v3: -Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as Jakub Kicinski suggested. Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Wang Yufen <wangyufen@huawei.com> Link: https://lore.kernel.org/r/20220607120028.845916-1-wangyufen@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-06-22 14:27:54 +02:00
..
ila	net: ipv6: check return value of rhashtable_init	2021-09-28 12:59:24 +01:00
netfilter	netfilter: nft_fib: add reduce support	2022-03-20 00:29:47 +01:00
addrconf.c	ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL	2022-06-09 10:29:39 +02:00
addrconf_core.c	ipv6: add net device refcount tracker to struct inet6_dev	2021-12-06 16:05:11 -08:00
addrlabel.c
af_inet6.c	ipv6: annotate some data-races around sk->sk_prot	2022-02-18 11:53:28 +00:00
ah6.c	ipv6: ah6: use swap() to make code cleaner	2021-11-18 12:00:15 +00:00
anycast.c
calipso.c
datagram.c	net: annotate races around sk->sk_bound_dev_if	2022-06-09 10:30:14 +02:00
esp6.c	esp: limit skb_page_frag_refill use to a single page	2022-04-13 10:16:11 +02:00
esp6_offload.c	net: Fix esp GSO on inter address family tunnels.	2022-03-07 13:14:04 +01:00
exthdrs.c	ipv6: partially inline ipv6_fixup_options	2022-01-27 19:46:11 -08:00
exthdrs_core.c
exthdrs_offload.c
fib6_notifier.c
fib6_rules.c	ipv6: change fib6_rules_net_exit() to batch mode	2022-02-08 20:41:34 -08:00
fou6.c
icmp.c	ipv6: do not use per netns icmp sockets	2022-01-25 11:25:21 +00:00
inet6_connection_sock.c
inet6_hashtables.c	secure_seq: use the 64 bits of the siphash for port offset calculation	2022-05-04 19:22:20 -07:00
ioam6.c	net: ipv6: Get rcv timestamp if needed when handling hop-by-hop IOAM option	2022-03-03 14:38:48 +00:00
ioam6_iptunnel.c	ipv6: ioam: Insertion frequency in lwtunnel output	2022-02-04 20:24:45 -08:00
ip6_checksum.c
ip6_fib.c	ipv6: annotate accesses to fn->fn_sernum	2022-01-20 20:18:37 -08:00
ip6_flowlabel.c	ipv6: per-netns exclusive flowlabel checks	2022-02-16 20:37:47 -08:00
ip6_gre.c	ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode	2022-04-25 11:40:45 +01:00
ip6_icmp.c
ip6_input.c	net: Postpone skb_clear_delivery_time() until knowing the skb is delivered locally	2022-03-03 14:38:48 +00:00
ip6_offload.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-02-24 17:54:25 -08:00
ip6_offload.h
ip6_output.c	ipv6: Fix signed integer overflow in __ip6_append_data	2022-06-22 14:27:54 +02:00
ip6_tunnel.c	ip6_tunnel: fix possible NULL deref in ip6_tnl_xmit	2022-02-09 11:56:19 +00:00
ip6_udp_tunnel.c
ip6_vti.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-12-30 12:12:12 -08:00
ip6mr.c	net: ipv6mr: fix unused variable warning with CONFIG_IPV6_PIMSM_V2=n	2022-04-06 15:14:30 +01:00
ipcomp6.c	xfrm: remove hdr_offset indirection	2021-06-11 14:48:50 +02:00
ipv6_sockglue.c	ipv6: annotate some data-races around sk->sk_prot	2022-02-18 11:53:28 +00:00
Kconfig	ipv6: ioam: Add support for the ip6ip6 encapsulation	2021-10-04 12:53:35 +01:00
Makefile	net: ipv6: use ipv6-y directly instead of ipv6-objs	2021-09-28 13:13:40 +01:00
mcast.c	mld: respect RCU rules in ip6_mc_source() and ip6_mc_msfilter()	2022-04-30 15:19:08 +01:00
mcast_snoop.c	net: bridge: mcast: fix broken length + header check for MRDv6 Adv.	2021-04-27 14:02:06 -07:00
mip6.c	xfrm: ipv6: move mip6_rthdr_offset into xfrm core	2021-06-11 14:48:50 +02:00
ndisc.c	ipv6: separate ndisc_ns_create() from ndisc_send_ns()	2022-02-21 12:13:45 +00:00
netfilter.c	netfilter: Update ip6_route_me_harder to consider L3 domain	2022-04-25 11:09:20 +02:00
output_core.c	ipv6: use prandom_u32() for ID generation	2021-05-31 22:12:08 -07:00
ping.c	net: ping6: Fix ping -6 with interface name	2022-06-14 18:44:59 +02:00
proc.c
protocol.c
raw.c	ipv6: raw: check passed optlen before reading	2021-12-29 12:32:56 -08:00
reassembly.c	net: ipv6: Handle delivery_time in ipv6 defrag	2022-03-03 14:38:48 +00:00
route.c	ipv6: make ip6_rt_gc_expire an atomic_t	2022-04-15 14:28:50 -07:00
rpl.c
rpl_iptunnel.c
seg6.c	icmp: ICMPV6: Examine invoking packet for Segment Route Headers.	2022-01-04 12:17:35 +00:00
seg6_hmac.c	net: ipv6: unexport __init-annotated seg6_hmac_init()	2022-06-14 18:45:06 +02:00
seg6_iptunnel.c	seg6: fix the iif in the IPv6 socket control block	2021-12-09 07:55:42 -08:00
seg6_local.c	net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev	2022-06-14 18:45:08 +02:00
sit.c	sit: allow encapsulated IPv6 traffic to be delivered locally	2022-01-12 13:56:07 -08:00
syncookies.c	tcp: make sure treq->af_specific is initialized	2022-04-25 12:10:11 +01:00
sysctl_net_ipv6.c	ipv6: ioam: Data plane support for Pre-allocated Trace	2021-07-21 08:14:33 -07:00
tcp_ipv6.c	tcp: add accessors to read/set tp->snd_cwnd	2022-06-14 18:44:56 +02:00
tcpv6_offload.c	net: move gro definitions to include/net/gro.h	2021-11-16 13:16:54 +00:00
tunnel6.c
udp.c	net: annotate races around sk->sk_bound_dev_if	2022-06-09 10:30:14 +02:00
udp_impl.h
udp_offload.c	gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers	2021-11-24 17:21:42 -08:00
udplite.c
xfrm6_input.c
xfrm6_output.c	xfrm: fix tunnel model fragmentation behavior	2022-03-01 12:08:40 +01:00
xfrm6_policy.c	net: Add l3mdev index to flow struct and avoid oif reset for port devices	2022-03-15 20:20:02 -07:00
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c	xfrm: remove description from xfrm_type struct	2021-06-09 09:38:52 +02:00