diff options
| author | Michael Tuexen <tuexen@FreeBSD.org> | 2026-01-16 11:49:40 +0000 |
|---|---|---|
| committer | Michael Tuexen <tuexen@FreeBSD.org> | 2026-01-16 11:49:40 +0000 |
| commit | 1f5b1de1fdf2924066c1851ed6c73f36fe20b438 (patch) | |
| tree | d759e83b45b08386980cd24b690c4913e062f17c | |
| parent | f8ddf74175c8013268e65b18750e247306fa088a (diff) | |
ipv6: account for jumbo payload option
If a jumbo payload option is added, the length of the mbuf chain is
increased by 8 but the actual hop-by-hop extension header with the
jumbo playload option is only inserted in the packet if there are
other options. Therefore, adjust optlen to reflect the actual size
of IPv6 extension headers including the hop-by-hop extension header
containing the jumbo payload option.
Reported by: syzbot+73fe316271df473230eb@syzkaller.appspotmail.com
Reviewed by: markj, Timo Voelker
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D54394
| -rw-r--r-- | sys/netinet6/ip6_output.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c index eb5a3a971ea0..d61bc983cc12 100644 --- a/sys/netinet6/ip6_output.c +++ b/sys/netinet6/ip6_output.c @@ -556,6 +556,7 @@ ip6_output(struct mbuf *m0, struct ip6_pktopts *opt, if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0) goto freehdrs; ip6->ip6_plen = 0; + optlen += 8; /* JUMBOOPTLEN */ } else ip6->ip6_plen = htons(plen); nexthdrp = &ip6->ip6_nxt; |