Date: Wed, 21 Jan 2026 19:51:22 +0000 From: Michael Tuexen <tuexen@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: fac164c2b341 - stable/15 - ipv6: account for jumbo payload option Message-ID: <69712e3a.c195.5bbe3955@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/15 has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=fac164c2b341afe6a84cb4da487d5233caa5af6e commit fac164c2b341afe6a84cb4da487d5233caa5af6e Author: Michael Tuexen <tuexen@FreeBSD.org> AuthorDate: 2026-01-16 11:49:40 +0000 Commit: Michael Tuexen <tuexen@FreeBSD.org> CommitDate: 2026-01-21 19:51:01 +0000 ipv6: account for jumbo payload option If a jumbo payload option is added, the length of the mbuf chain is increased by 8 but the actual hop-by-hop extension header with the jumbo playload option is only inserted in the packet if there are other options. Therefore, adjust optlen to reflect the actual size of IPv6 extension headers including the hop-by-hop extension header containing the jumbo payload option. Reported by: syzbot+73fe316271df473230eb@syzkaller.appspotmail.com Reviewed by: markj, Timo Voelker Differential Revision: https://reviews.freebsd.org/D54394 (cherry picked from commit 1f5b1de1fdf2924066c1851ed6c73f36fe20b438) --- sys/netinet6/ip6_output.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c index 6299ce6e146b..6e256b1105bf 100644 --- a/sys/netinet6/ip6_output.c +++ b/sys/netinet6/ip6_output.c @@ -557,6 +557,7 @@ ip6_output(struct mbuf *m0, struct ip6_pktopts *opt, if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0) goto freehdrs; ip6->ip6_plen = 0; + optlen += 8; /* JUMBOOPTLEN */ } else ip6->ip6_plen = htons(plen); nexthdrp = &ip6->ip6_nxt;home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?69712e3a.c195.5bbe3955>