From nobody Wed Feb 11 04:01:07 2026 Received: from szxga07-in.huawei.com (szxga07-in.huawei.com [45.249.212.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E0325490E; Mon, 22 Apr 2024 09:20:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.35 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713777618; cv=none; b=QEOCYZrvGOYuoa3BlKNPh2WPx4ramBd3vUCGkSU3U/Ounsw6I/k9MXYB818sFeFPuMQz0WKR/cHHwfKeRrZ4GwWoLaCDKUr5M6kGUjsr+YA/QSfKTmvRuXL9XeCL25v09HGjNgppzVLfY47CZkPLLxV+AZhiCmbT4DpcAgOUXs0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713777618; c=relaxed/simple; bh=mQQw5lMBFpwd1ib2VzuyorFSwtH397b/MvRxcKg2qkE=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=q1SmGkMnwjdaY3DVXKvxYSfTKHHtUhZ0XchSVW7arOJE2RQNJxBwl5aehAF3qNhoNcph8crVaVZB/JzZqW0ACRjWRnP7FswFEMDZNDOZk0W9PgZvmkhwJX5z6CzaoCO6NyUQjkYyEMi6OFyUD+db8OiAUmwUGKIqT7ZYcklTbX8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; arc=none smtp.client-ip=45.249.212.35 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Received: from mail.maildlp.com (unknown [172.19.162.112]) by szxga07-in.huawei.com (SkyGuard) with ESMTP id 4VNKQ772jWz1RCjQ; Mon, 22 Apr 2024 17:17:03 +0800 (CST) Received: from dggpemd500003.china.huawei.com (unknown [7.185.36.29]) by mail.maildlp.com (Postfix) with ESMTPS id B842C1403D2; Mon, 22 Apr 2024 17:20:06 +0800 (CST) Received: from localhost.localdomain (10.175.101.6) by dggpemd500003.china.huawei.com (7.185.36.29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.28; Mon, 22 Apr 2024 17:20:06 +0800 From: gaoxingwang To: CC: , , , , , , , Subject: [PATCH v2] net: ipv6: fix wrong start position when receive hop-by-hop fragment Date: Mon, 22 Apr 2024 17:19:17 +0800 Message-ID: <20240422091917.3221601-1-gaoxingwang1@huawei.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20240422011052.2932165-1-gaoxingwang1@huawei.com> References: <20240422011052.2932165-1-gaoxingwang1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To dggpemd500003.china.huawei.com (7.185.36.29) Content-Type: text/plain; charset="utf-8" In IPv6, ipv6_rcv_core will parse the hop-by-hop type extension header and = increase skb->transport_header by one extension header length. But if there are more other extension headers like fragment header at this = time, the skb->transport_header points to the second extension header, not the transport layer header or the first extension header. This will result in the start and nexthdrp variable not pointing to the sam= e position in ipv6frag_thdr_trunced, and ipv6_skip_exthdr returning incorrect offset and frag_off.Sometimes,the = length of the last sharded packet is smaller than the calculated incorrect = offset, resulting in packet loss. We can use network header to offset and calculate the correct position to s= olve this problem. Fixes: 9d9e937b1c8b (ipv6/netfilter: Discard first fragment not including a= ll headers) Signed-off-by: Gao Xingwang --- net/ipv6/reassembly.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c index 5ebc47da1000..2af98edef87e 100644 --- a/net/ipv6/reassembly.c +++ b/net/ipv6/reassembly.c @@ -369,7 +369,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb) * the source of the fragment, with the Pointer field set to zero. */ nexthdr =3D hdr->nexthdr; - if (ipv6frag_thdr_truncated(skb, skb_transport_offset(skb), &nexthdr)) { + if (ipv6frag_thdr_truncated(skb, skb_network_offset(skb) + sizeof(struct = ipv6hdr), &nexthdr)) { __IP6_INC_STATS(net, __in6_dev_get_safely(skb->dev), IPSTATS_MIB_INHDRERRORS); icmpv6_param_prob(skb, ICMPV6_HDR_INCOMP, 0); --=20 2.27.0