rte_ipv6_fragment_packet() does not check that the first mbuf segment
is large enough to hold the IPv6 header, unlike the IPv4 version,
which validates data_len against the header length.
With data_len < 40, in_seg_data_pos starts past the end of the
segment, the expression (in_seg->data_len - in_seg_data_pos)
underflows and the loop never advances to the next segment, so it
keeps producing fragments and writing past the end of pkts_out.
Reject such packets with -EINVAL, as rte_ipv4_fragment_packet() does.
Fixes: 0aa31d7a5929 ("ip_frag: add IPv6 fragmentation support")
Cc: [email protected]
Signed-off-by: Alexey Simakov <[email protected]>
---
lib/ip_frag/rte_ipv6_fragmentation.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/lib/ip_frag/rte_ipv6_fragmentation.c
b/lib/ip_frag/rte_ipv6_fragmentation.c
index c81f2402e3..fac72f84d2 100644
--- a/lib/ip_frag/rte_ipv6_fragmentation.c
+++ b/lib/ip_frag/rte_ipv6_fragmentation.c
@@ -89,6 +89,14 @@ rte_ipv6_fragment_packet(struct rte_mbuf *pkt_in,
unlikely(mtu_size < RTE_IPV6_MIN_MTU))
return -EINVAL;
+ /*
+ * Check that the first segment is big enough to hold the IPv6
+ * header; otherwise in_seg_data_pos starts past its end, the
+ * difference below underflows and the loop never terminates.
+ */
+ if (unlikely(pkt_in->data_len < sizeof(struct rte_ipv6_hdr)))
+ return -EINVAL;
+
/*
* Ensure the IP payload length of all fragments (except the
* last fragment) are a multiple of 8 bytes per RFC2460.
--
2.53.0
