From nobody Fri Jan 16 11:53:23 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dsysv5pMFz6P9ds for ; Fri, 16 Jan 2026 11:53:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dsysv2k5nz3xfY for ; Fri, 16 Jan 2026 11:53:23 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1768564403; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=fuHMpYsVKbMOI6lF65ZNLTWh9y7TnwSW9p1tZhWyxgQ=; b=cd5OYVbsS5WdahD2gnaEdYSBy0KDGbck5XGm6/8buGjjO4HWH0sT5Ak59zVLNFQ4zo+l56 P4qByQS9rATDJnNAcgPKfgxOsjqeQAoNxDEjSmyu+0+O+ebrnH2pG0YHTUNj8mJxxBWkzb FGtFBpVy795rcsZmXihLbNhmlqACa8v+EHCkNC7nxCKDBRCfxNpDhwERRtusqC2mZTBSyI kZxboB1LsMiR7u150UkmsCH4+WKzF3ISYV/sCTN5rM36bvn9pYXF1AD3VQuPY0AUjIUD95 EBJmrU9JkiPoh37J3nX9FoaPYk4NPjLNM5id6tCsrknD5i5dhYPNBQrAvW4jrA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1768564403; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=fuHMpYsVKbMOI6lF65ZNLTWh9y7TnwSW9p1tZhWyxgQ=; b=ttOWNKAoTiffyjip1so+Eao+Z7gRoIKQ1xFb+UkyZ30QrtlRttQOa6xsjeSdJ5M0sLrRSD UMF4eSDNUBQSKjO4+pTD6pw+mnrxjs+Eq6FyjCqB9LBDWzBgKRuBnjeJkYybMJxmCDeXHK Ni57bV+SAqHB9ptLFIErxoNzFwsG8zg1fyyOAmjpuUOAoINsbmp0WpPfByY81kRUEwBOwQ cx8c6BRpCQab6Zv/ZoyHiaAkRexe+9Kfx3u9Wylbz8pIVKAzw96ghADtuj6mVsplcAmTkf wllabTtAWhkq66KXJenFCxiJL64wx+2fd1Ygq7W19GJspBB1DA0YusNaGygnxQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1768564403; a=rsa-sha256; cv=none; b=LIYIriqsWfnty0W+NjGfc6Uns3gIJe0vnuMWrA8lJpDM7VK9Aith0aFjz/RW+adFZG0/dT BBmvOVeF9rx8ecBjxLwR12G0c9ULp6yycg1GLGnsaPgMQ/9aysKqSCBuKhOj3rv72YAPdd fZOEuBks1YbrKZqZ+nko3FrZJtHyPPLk9V0jX7SL/OY8rH954dYiTOnzBD2Bmvyiv600n7 4LjIt4Yzi44miCwX4Vt6R+DpT8ZzSJhMmvJ8wc51tkSKJI7iqB1fj1hjMv+gOj96advs9z 8X51AUu6Sr7gCE91wd17RJPstcbaakEz2WcXe+/W20YRfMWcoKQsUu+6UMpzyQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dsysv2Hzyz1BkK for ; Fri, 16 Jan 2026 11:53:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 38380 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 16 Jan 2026 11:53:23 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Michael Tuexen Subject: git: 1f5b1de1fdf2 - main - ipv6: account for jumbo payload option List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 1f5b1de1fdf2924066c1851ed6c73f36fe20b438 Auto-Submitted: auto-generated Date: Fri, 16 Jan 2026 11:53:23 +0000 Message-Id: <696a26b3.38380.b68e7bb@gitrepo.freebsd.org> The branch main has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=1f5b1de1fdf2924066c1851ed6c73f36fe20b438 commit 1f5b1de1fdf2924066c1851ed6c73f36fe20b438 Author: Michael Tuexen AuthorDate: 2026-01-16 11:49:40 +0000 Commit: Michael Tuexen CommitDate: 2026-01-16 11:49:40 +0000 ipv6: account for jumbo payload option If a jumbo payload option is added, the length of the mbuf chain is increased by 8 but the actual hop-by-hop extension header with the jumbo playload option is only inserted in the packet if there are other options. Therefore, adjust optlen to reflect the actual size of IPv6 extension headers including the hop-by-hop extension header containing the jumbo payload option. Reported by: syzbot+73fe316271df473230eb@syzkaller.appspotmail.com Reviewed by: markj, Timo Voelker MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D54394 --- sys/netinet6/ip6_output.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c index eb5a3a971ea0..d61bc983cc12 100644 --- a/sys/netinet6/ip6_output.c +++ b/sys/netinet6/ip6_output.c @@ -556,6 +556,7 @@ ip6_output(struct mbuf *m0, struct ip6_pktopts *opt, if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0) goto freehdrs; ip6->ip6_plen = 0; + optlen += 8; /* JUMBOOPTLEN */ } else ip6->ip6_plen = htons(plen); nexthdrp = &ip6->ip6_nxt;