This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Hurd".
The branch, master has been updated
via 6b8b18b3a227acff76fa92cb4c3a3f6b46684168 (commit)
from e50af60f7f682d7b9067e6579bad278081a66848 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 6b8b18b3a227acff76fa92cb4c3a3f6b46684168
Author: David Bidner <[email protected]>
Date: Fri Sep 18 18:14:05 2026 +0200
pfinet: Fix IPv6 over the tunnel device
trivfs_S_io_write() set skb->len without advancing skb->tail, so an IPv6
packet reached ip6_input() with skb->tail == skb->data. ip6_input()
derives its payload length from skb->tail - skb->h.raw, so icmpv6_rcv()
got a negative length; its unsigned check passed it to csum_partial(),
crashing pfinet.
The function also hardcoded ETH_P_IP, sending IPv6 to ip_rcv(). Classify
by the version nibble.
* pfinet/tunnel.c (trivfs_S_io_write): Use skb_put() so skb->tail and
skb->len advance together, and set skb->protocol from the version nibble.
Message-ID: <[email protected]>
-----------------------------------------------------------------------
Summary of changes:
pfinet/tunnel.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
hooks/post-receive
--
Hurd
