[PATCH] ip_frag: fix IPv6 fragmentation of short packets

[Alexey Simakov]

rte_ipv6_fragment_packet() does not check that the first mbuf segment
is large enough to hold the IPv6 header, unlike the IPv4 version,
which validates data_len against the header length.

With data_len < 40, in_seg_data_pos starts past the end of the
segment, the expression (in_seg->data_len - in_seg_data_pos)
underflows and the loop never advances to the next segment, so it
keeps producing fragments and writing past the end of pkts_out.

Reject such packets with -EINVAL, as rte_ipv4_fragment_packet() does.

Fixes: 0aa31d7a5929 ("ip_frag: add IPv6 fragmentation support")
Cc: stable at dpdk.org

Signed-off-by: Alexey Simakov <bigalex934 at gmail.com>
---
 lib/ip_frag/rte_ipv6_fragmentation.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/ip_frag/rte_ipv6_fragmentation.c b/lib/ip_frag/rte_ipv6_fragmentation.c
index c81f2402e3..fac72f84d2 100644
--- a/lib/ip_frag/rte_ipv6_fragmentation.c
+++ b/lib/ip_frag/rte_ipv6_fragmentation.c
@@ -89,6 +89,14 @@ rte_ipv6_fragment_packet(struct rte_mbuf *pkt_in,
 	    unlikely(mtu_size < RTE_IPV6_MIN_MTU))
 		return -EINVAL;
 
+	/*
+	 * Check that the first segment is big enough to hold the IPv6
+	 * header; otherwise in_seg_data_pos starts past its end, the
+	 * difference below underflows and the loop never terminates.
+	 */
+	if (unlikely(pkt_in->data_len < sizeof(struct rte_ipv6_hdr)))
+		return -EINVAL;
+
 	/*
 	 * Ensure the IP payload length of all fragments (except the
 	 * last fragment) are a multiple of 8 bytes per RFC2460.
-- 
2.53.0