Re: [PATCH v3 net] ipv6: Fix dangling pointer when ipv6 fragment

[Dan Carpenter]

Hi hujunwei,

url:    https://github.com/0day-ci/linux/commits/hujunwei/ipv6-Fix-dangling-pointer-when-ipv6-fragment/20190402-175602

New smatch warnings:
net/ipv6/ip6_output.c:609 ip6_fragment() error: uninitialized symbol 'prevhdr'.

Old smatch warnings:
net/ipv6/ip6_output.c:247 ip6_xmit() error: we previously assumed 'np' could be null (see line 241)

# https://github.com/0day-ci/linux/commit/7f25fe5b3011737e52e4d8b4a2dfcafd46677115
git remote add linux-review https://github.com/0day-ci/linux
git remote update linux-review
git checkout 7f25fe5b3011737e52e4d8b4a2dfcafd46677115
vim +/prevhdr +609 net/ipv6/ip6_output.c

^1da177e4 Linus Torvalds             2005-04-16  594  
7d8c6e391 Eric W. Biederman          2015-06-12  595  int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
7d8c6e391 Eric W. Biederman          2015-06-12  596  		 int (*output)(struct net *, struct sock *, struct sk_buff *))
^1da177e4 Linus Torvalds             2005-04-16  597  {
^1da177e4 Linus Torvalds             2005-04-16  598  	struct sk_buff *frag;
adf30907d Eric Dumazet               2009-06-02  599  	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
f60e5990d hannes@xxxxxxxxxxxxxxxxxxx 2015-04-01  600  	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
f60e5990d hannes@xxxxxxxxxxxxxxxxxxx 2015-04-01  601  				inet6_sk(skb->sk) : NULL;
^1da177e4 Linus Torvalds             2005-04-16  602  	struct ipv6hdr *tmp_hdr;
^1da177e4 Linus Torvalds             2005-04-16  603  	struct frag_hdr *fh;
7f25fe5b3 Junwei Hu                  2019-04-02  604  	unsigned int mtu, hlen, left, len, nexthdr_offset;
a7ae19922 Herbert Xu                 2011-11-18  605  	int hroom, troom;
286c2349f Martin KaFai Lau           2015-05-22  606  	__be32 frag_id;
^1da177e4 Linus Torvalds             2005-04-16  607  	int ptr, offset = 0, err = 0;
^1da177e4 Linus Torvalds             2005-04-16  608  	u8 *prevhdr, nexthdr = 0;
                                                            ^^^^^^^^
7f25fe5b3 Junwei Hu                  2019-04-02 @609  	nexthdr_offset = prevhdr - skb_network_header(skb);
                                                                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^1da177e4 Linus Torvalds             2005-04-16  610  
7dd7eb951 David S. Miller            2017-05-17  611  	err = ip6_find_1stfragopt(skb, &prevhdr);
                                                                                       ^^^^^^^^
7dd7eb951 David S. Miller            2017-05-17  612  	if (err < 0)
2423496af Craig Gallek               2017-05-16  613  		goto fail;
7dd7eb951 David S. Miller            2017-05-17  614  	hlen = err;
^1da177e4 Linus Torvalds             2005-04-16  615  	nexthdr = *prevhdr;
^1da177e4 Linus Torvalds             2005-04-16  616  
628a5c561 John Heffner               2007-04-20  617  	mtu = ip6_skb_dst_mtu(skb);
b881ef760 John Heffner               2007-04-20  618  
b881ef760 John Heffner               2007-04-20  619  	/* We must not fragment if the socket is set to force MTU discovery

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation