rte_ipv6_fragment_packet() does not check that the first mbuf segment is large enough to hold the IPv6 header, unlike the IPv4 version, which validates data_len against the header length. With data_len < 40, in_seg_data_pos starts past the end of the segment, the expression (in_seg->data_len - in_seg_data_pos) underflows and the loop never advances to the next segment, so it keeps producing fragments and writing past the end of pkts_out. Reject such packets with -EINVAL, as rte_ipv4_fragment_packet() does. Fixes: 0aa31d7a5929 ("ip_frag: add IPv6 fragmentation support") Cc: [email protected] Signed-off-by: Alexey Simakov <[email protected]> --- lib/ip_frag/rte_ipv6_fragmentation.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/lib/ip_frag/rte_ipv6_fragmentation.c b/lib/ip_frag/rte_ipv6_fragmentation.c index c81f2402e3..fac72f84d2 100644 --- a/lib/ip_frag/rte_ipv6_fragmentation.c +++ b/lib/ip_frag/rte_ipv6_fragmentation.c @@ -89,6 +89,14 @@ rte_ipv6_fragment_packet(struct rte_mbuf *pkt_in, unlikely(mtu_size < RTE_IPV6_MIN_MTU)) return -EINVAL;+ /*+ * Check that the first segment is big enough to hold the IPv6 + * header; otherwise in_seg_data_pos starts past its end, the + * difference below underflows and the loop never terminates. + */ + if (unlikely(pkt_in->data_len < sizeof(struct rte_ipv6_hdr))) + return -EINVAL; + /* * Ensure the IP payload length of all fragments (except the * last fragment) are a multiple of 8 bytes per RFC2460.
Acked-by: Konstantin Ananyev <[email protected]>
