patch 'ip_frag: drop IPv6 fragments with per-fragment headers' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 08/04/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/22ab673ae2161dbaf96e4fcbf471ac2132694f56

Thanks.

Kevin

---
>From 22ab673ae2161dbaf96e4fcbf471ac2132694f56 Mon Sep 17 00:00:00 2001
From: Stephen Hemminger <stephen at networkplumber.org>
Date: Wed, 1 Jul 2026 09:20:29 -0700
Subject: [PATCH] ip_frag: drop IPv6 fragments with per-fragment headers

[ upstream commit 3d9ffda1a711a7b5743cb4f472787c2c4d8a8257 ]

IPv6 reassembly assumes the fragment header directly follows the IPv6
header. ipv6_frag_reassemble() patches the next-header field and removes
the fragment header at a fixed offset, so a fragment with per-fragment
extension headers before the fragment header reassembles to a corrupt
datagram.

Drop the fragment when its fragment header does not directly follow the
IPv6 header. Headers after the fragment header are payload and are
unaffected.

RFC 8200 permits discarding packets with extension headers out of the
recommended order, and RFC 9099 recommends dropping non-conforming
fragmented packets.

Fixes: 4f1a8f633862 ("ip_frag: add IPv6 reassembly")

Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
Acked-by: Konstantin Ananyev <konstantin.ananyev at huawei.com>
---
 lib/ip_frag/rte_ipv6_reassembly.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/lib/ip_frag/rte_ipv6_reassembly.c b/lib/ip_frag/rte_ipv6_reassembly.c
index 0e809a01e5..b6f623d53b 100644
--- a/lib/ip_frag/rte_ipv6_reassembly.c
+++ b/lib/ip_frag/rte_ipv6_reassembly.c
@@ -181,4 +181,26 @@ rte_ipv6_frag_reassemble_packet(struct rte_ip_frag_tbl *tbl,
 	}
 
+	/*
+	 * Only a fragment header directly following the IPv6 header is supported.
+	 * Per-fragment (unfragmentable) extension headers placed
+	 * before the fragment header are not handled: ipv6_frag_reassemble()
+	 * patches the IPv6 header's next-header field and removes the fragment
+	 * header assuming it sits immediately after the IPv6 header, so such a
+	 * fragment would be reassembled into a corrupt datagram. Drop it.
+	 *
+	 * Extension headers after the fragment header (destination options,
+	 * AH, ESP, upper-layer) are part of the fragmentable payload and are
+	 * reassembled as opaque bytes, so they are not affected. The test uses
+	 * the fragment header's position rather than l3_len so that callers
+	 * which include later headers in l3_len are not rejected.
+	 */
+	if ((uintptr_t)frag_hdr != (uintptr_t)(ip_hdr + 1)) {
+		IP_FRAG_LOG(DEBUG,
+			    "%s:%d: drop fragment with header before frag header, offset %zu\n",
+			    __func__, __LINE__, (uintptr_t)frag_hdr - (uintptr_t)ip_hdr);
+		IP_FRAG_MBUF2DR(dr, mb);
+		return NULL;
+	}
+
 	if (unlikely(trim > 0))
 		rte_pktmbuf_trim(mb, trim);
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-30 10:16:02.349509637 +0100
+++ 0029-ip_frag-drop-IPv6-fragments-with-per-fragment-header.patch	2026-07-30 10:16:01.467600950 +0100
@@ -1 +1 @@
-From 3d9ffda1a711a7b5743cb4f472787c2c4d8a8257 Mon Sep 17 00:00:00 2001
+From 22ab673ae2161dbaf96e4fcbf471ac2132694f56 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 3d9ffda1a711a7b5743cb4f472787c2c4d8a8257 ]
+
@@ -21 +22,0 @@
-Cc: stable at dpdk.org
@@ -26,14 +27,3 @@
- doc/guides/rel_notes/release_26_07.rst |  1 +
- lib/ip_frag/rte_ipv6_reassembly.c      | 22 ++++++++++++++++++++++
- 2 files changed, 23 insertions(+)
-
-diff --git a/doc/guides/rel_notes/release_26_07.rst b/doc/guides/rel_notes/release_26_07.rst
-index 42fcd9af1b..bb3ad50dd6 100644
---- a/doc/guides/rel_notes/release_26_07.rst
-+++ b/doc/guides/rel_notes/release_26_07.rst
-@@ -306,4 +306,5 @@ API Changes
-   - Duplicate fragments are tolerated instead of failing reassembly.
-   - Overlapping fragments are rejected on arrival rather than during reassembly.
-+  - For IPv6, fragments with per-fragment extension headers are rejected.
- 
-   Overlap is now detected on arrival, which adds a scan of the
+ lib/ip_frag/rte_ipv6_reassembly.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+