From nobody Wed Jan 21 19:51:22 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dxFF70yd1z6PdnB for ; Wed, 21 Jan 2026 19:51:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dxFF66Gm5z3HmG for ; Wed, 21 Jan 2026 19:51:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1769025082; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rhn0NYspTd3xI6pRfAH0/ZYp/Mc5JvBGpyPIjZFLSHc=; b=S+iELNuo4fhiuIoKQLBMn3i8o3yKJTRJdGd51O8vR6ODYqvaabvlFR0lpYb7zuxmTrHg6/ BpmEH4l/u586/a4XyIiXxXHTj29yJUbQB3JwEMiXkv7UF8elUrseQVwedCRze+yohWO+ei AC4zWToDODeVYUOUgJbGKJ+fAsd/QbmKj6G3NRRntG84e4gofxVITaT03VXVajsYlsFsAW sUyfiq0xNcrDwpJsdcc1ULM9E31wL/K8uL6973QEVgPPAhEezREA0oDIBqRWvWnWPkwNFr 8pQK06+akHOP7/bEyXlMR0nWuN5rrnaRkZ3SAVw8HmtZ6HAtcj0NIvY1X9evMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1769025082; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=rhn0NYspTd3xI6pRfAH0/ZYp/Mc5JvBGpyPIjZFLSHc=; b=poFTU3Bl/TNc+dKgDQFKMX8oW9yLQ9cSUZzz020rZXLiMFWbV0uBqyHzjQU1RpH9izozo+ BZmtb3gvxtx9KeyYoKuTDMwyafhd7kYJPUZhB2PhCtpoVBahxOD0rxNRodi5S7bu8t+lDW WX2TepDND7Bv6fQhDKvvJ4oRmfS3rtbuuihb0AdhlVDr/H7Q/GEUdevDb9WXfsBg4dFxvf cwdCwg/RmU/WS9jiuBI7KKS5l9NieiPd+g2MGUWMpN/C8kcF/9xs0j2ih/K6IeCXb2sPdY fvTnlmnw0cJO8I2OkMOxjFTgvu2NWuinABZ0wky07TEMDxVp90DiEb/jzIbDAw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1769025082; a=rsa-sha256; cv=none; b=SDXaYPYZGRL5xtOOuYpT66VgSIAqx1Gp65LlioidLOtDNjACG4LVv7m5RzqMdwP3YGEvSx EgYzzBoXq/8IdL5YEuUHGSpo/XpNAls4jyjRzhRRCgbz+HlKQ8fwr7NXy0KuRlw7nklmZ3 21tIt4GPafMY9jg/5bh1CYbYWYqDYNUyCTni6PfMTZ/yJiQoQVOzG2wP2LsDHGRphS7yAY 66Oode3bop9UUc9eKztmAQWVz01fDizh9hZBXgRBWdag2guUhc9bASz6nesFEq+6/7o7YD OVRREzyRyWPapOTdFGrFKvoLarqcrRKvVzVL0EEYBbfBR8w3gcGwsj533D3GVg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dxFF65dNVz11Z4 for ; Wed, 21 Jan 2026 19:51:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id c195 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 21 Jan 2026 19:51:22 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Michael Tuexen Subject: git: fac164c2b341 - stable/15 - ipv6: account for jumbo payload option List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: fac164c2b341afe6a84cb4da487d5233caa5af6e Auto-Submitted: auto-generated Date: Wed, 21 Jan 2026 19:51:22 +0000 Message-Id: <69712e3a.c195.5bbe3955@gitrepo.freebsd.org> The branch stable/15 has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=fac164c2b341afe6a84cb4da487d5233caa5af6e commit fac164c2b341afe6a84cb4da487d5233caa5af6e Author: Michael Tuexen AuthorDate: 2026-01-16 11:49:40 +0000 Commit: Michael Tuexen CommitDate: 2026-01-21 19:51:01 +0000 ipv6: account for jumbo payload option If a jumbo payload option is added, the length of the mbuf chain is increased by 8 but the actual hop-by-hop extension header with the jumbo playload option is only inserted in the packet if there are other options. Therefore, adjust optlen to reflect the actual size of IPv6 extension headers including the hop-by-hop extension header containing the jumbo payload option. Reported by: syzbot+73fe316271df473230eb@syzkaller.appspotmail.com Reviewed by: markj, Timo Voelker Differential Revision: https://reviews.freebsd.org/D54394 (cherry picked from commit 1f5b1de1fdf2924066c1851ed6c73f36fe20b438) --- sys/netinet6/ip6_output.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c index 6299ce6e146b..6e256b1105bf 100644 --- a/sys/netinet6/ip6_output.c +++ b/sys/netinet6/ip6_output.c @@ -557,6 +557,7 @@ ip6_output(struct mbuf *m0, struct ip6_pktopts *opt, if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0) goto freehdrs; ip6->ip6_plen = 0; + optlen += 8; /* JUMBOOPTLEN */ } else ip6->ip6_plen = htons(plen); nexthdrp = &ip6->ip6_nxt;