Re: [PATCH net] ipv6: the entire IPv6 header chain must fit the first fragment

On 03/23/2018 06:05 AM, Paolo Abeni wrote:

While building ipv6 datagram we currently allow arbitrary large
extheaders, even beyond pmtu size. The syzbot has found a way
to exploit the above to trigger the following splat:

... 

As stated by RFC 7112 section 5:

   When a host fragments an IPv6 datagram, it MUST include the entire
   IPv6 Header Chain in the First Fragment.

So this patch addresses the issue dropping datagrams with excessive
extheader length. It also updates the error path to report to the
calling socket nonnegative pmtu values.

The issue apparently predates git history.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+91e6f9932ff122fa4410@syzkaller.appspotmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
 net/ipv6/ip6_output.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

I would suggest :

pmtu = max_t(int, mtu - headersize + sizeof(struct ipv6hdr), 0);

And you can omit the comment, since the max_t() intent is obvious.

Thanks for working on this syzbot report.