From nobody Wed Jan 21 14:11:45 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dx5jF5P6Hz6PGVy for ; Wed, 21 Jan 2026 14:11:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dx5jF2jSjz3SNN for ; Wed, 21 Jan 2026 14:11:45 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1769004705; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XotLaQObxIp0Eo1PBkZKwjg6fNgsceZJhDgCnYgu9gg=; b=fCkrY4g73CHTi7Yy0w9RaxSnJDSTONebu39bILp3n73+wz45Xl2kxWpKjaV52frRHvhmJ7 TPJdRO7FaNae/slqhnR1CVBhiUTtSzZ+9UdB024/bejliy+NteqRFr3F1DcYIDI+74plR8 ST6KuhtjxavNsM3pv76PtEXJQL+lDetlEkzSu9ef6I9RnvIWeW4NZ+3hpQ0D4GQpj4ftcV 0VbOdr6QGiyIX2FAvOsXm61oXop62EEqQvdFigjluYzq81UBbqYQ8McYqcxueRBkKLgv4T 4sR/9MDyCAWL15i+R3NREGR6Pv4oOO3n5eKs6qb2Ibspv+7uOtThz83Y8D+aYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1769004705; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=XotLaQObxIp0Eo1PBkZKwjg6fNgsceZJhDgCnYgu9gg=; b=oys7Ohq6BXlIsv+6/YVnrZ8PPBtihKCH1ZH/4Bs5jVHxWYsmOIUwl20t7NwbHXW+y6q16B hLpHtaepeAepI2ioU0wTRfopUk9cbalW/frW93ii2LVC3dzB/10TnbyQVOGTxj9iKxYoi4 TcJdKi6yKgUQGSWnLQBOXKyGdCrjIp/UpDBKvb2wFtq1NBIRSQejJFtTZMaiiAp+iX4NMf F7T4wWS/4XgvtlLhet/10uiZhr3sC4um+6FYGcYKZoLQOkVXUTvj/TkyMeuLhPcg06wXG3 4MrUXwQHCl9joamgkBbEZS53pEWRtnBmkTTrTlUwl9sittPESWf9doBnzW5ReA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1769004705; a=rsa-sha256; cv=none; b=Bo9V0moCHDaPUSaVeYKWnAH9eZrDyjiOjZBZQBmMVn0nRwM24CvDeGzMIn5yGt3eUijRfq 6z6TK/8yCJwjNNwW+exbAxH3FG280TScM8aUsBhIgu/6uKrsszyvc7D5pz9EtfInJgRfl4 xijyR/L4Mxm9u5Exe6IcSi/zkkTb1WXCcFLL9mlcn0VaCMzm6/L8/b7k2x97o58FzNjU6q MFvr3/K4tMlrgqPhSvBOQVP/Wl6FZD+Yg7KdM0/IgKEH998tfpDlRMkJLy+jqal8KCGLk1 EvwWYDcILDEekx7u7jvy/3uD7Day2qE9NeDqRXmhOu6FUNH3LbU1waFK2AmMvw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dx5jF2GS6zqmb for ; Wed, 21 Jan 2026 14:11:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 227f6 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 21 Jan 2026 14:11:45 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Michael Tuexen Subject: git: 3fdfc6c77aad - stable/14 - ipv6: account for jumbo payload option List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 3fdfc6c77aad8eacce0a8e609cc435db1070d726 Auto-Submitted: auto-generated Date: Wed, 21 Jan 2026 14:11:45 +0000 Message-Id: <6970dea1.227f6.54c824cf@gitrepo.freebsd.org> The branch stable/14 has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=3fdfc6c77aad8eacce0a8e609cc435db1070d726 commit 3fdfc6c77aad8eacce0a8e609cc435db1070d726 Author: Michael Tuexen AuthorDate: 2026-01-16 11:49:40 +0000 Commit: Michael Tuexen CommitDate: 2026-01-21 14:05:01 +0000 ipv6: account for jumbo payload option If a jumbo payload option is added, the length of the mbuf chain is increased by 8 but the actual hop-by-hop extension header with the jumbo playload option is only inserted in the packet if there are other options. Therefore, adjust optlen to reflect the actual size of IPv6 extension headers including the hop-by-hop extension header containing the jumbo payload option. Reported by: syzbot+73fe316271df473230eb@syzkaller.appspotmail.com Reviewed by: markj, Timo Voelker Differential Revision: https://reviews.freebsd.org/D54394 (cherry picked from commit 1f5b1de1fdf2924066c1851ed6c73f36fe20b438) --- sys/netinet6/ip6_output.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c index afc8b60e4cbe..10569b7d1026 100644 --- a/sys/netinet6/ip6_output.c +++ b/sys/netinet6/ip6_output.c @@ -584,6 +584,7 @@ no_ipsec:; if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0) goto freehdrs; ip6->ip6_plen = 0; + optlen += 8; /* JUMBOOPTLEN */ } else ip6->ip6_plen = htons(plen); nexthdrp = &ip6->ip6_nxt;