[PATCH] ip_frag: fix IPv6 fragmentation of short packets

[Konstantin Ananyev]

> rte_ipv6_fragment_packet() does not check that the first mbuf segment
> is large enough to hold the IPv6 header, unlike the IPv4 version,
> which validates data_len against the header length.
>
> With data_len < 40, in_seg_data_pos starts past the end of the
> segment, the expression (in_seg->data_len - in_seg_data_pos)
> underflows and the loop never advances to the next segment, so it
> keeps producing fragments and writing past the end of pkts_out.
>
> Reject such packets with -EINVAL, as rte_ipv4_fragment_packet() does.
>
> Fixes: 0aa31d7a5929 ("ip_frag: add IPv6 fragmentation support")
> Cc: stable at dpdk.org
>
> Signed-off-by: Alexey Simakov <bigalex934 at gmail.com>
> ---
>   lib/ip_frag/rte_ipv6_fragmentation.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
>
> diff --git a/lib/ip_frag/rte_ipv6_fragmentation.c b/lib/ip_frag/rte_ipv6_fragmentation.c
> index c81f2402e3..fac72f84d2 100644
> --- a/lib/ip_frag/rte_ipv6_fragmentation.c
> +++ b/lib/ip_frag/rte_ipv6_fragmentation.c
> @@ -89,6 +89,14 @@ rte_ipv6_fragment_packet(struct rte_mbuf *pkt_in,
>   	    unlikely(mtu_size < RTE_IPV6_MIN_MTU))
>   		return -EINVAL;
>   
> +	/*
> +	 * Check that the first segment is big enough to hold the IPv6
> +	 * header; otherwise in_seg_data_pos starts past its end, the
> +	 * difference below underflows and the loop never terminates.
> +	 */
> +	if (unlikely(pkt_in->data_len < sizeof(struct rte_ipv6_hdr)))
> +		return -EINVAL;
> +
>   	/*
>   	 * Ensure the IP payload length of all fragments (except the
>   	 * last fragment) are a multiple of 8 bytes per RFC2460.

Acked-by: Konstantin Ananyev <konstantin.v.ananyev at yandex.ru>