[PATCH] ip_frag: fix IPv6 fragmentation of short packets

[Thomas Monjalon]

20/10/2026 10:01, Konstantin Ananyev:
> 
> > rte_ipv6_fragment_packet() does not check that the first mbuf segment
> > is large enough to hold the IPv6 header, unlike the IPv4 version,
> > which validates data_len against the header length.
> >
> > With data_len < 40, in_seg_data_pos starts past the end of the
> > segment, the expression (in_seg->data_len - in_seg_data_pos)
> > underflows and the loop never advances to the next segment, so it
> > keeps producing fragments and writing past the end of pkts_out.
> >
> > Reject such packets with -EINVAL, as rte_ipv4_fragment_packet() does.
> >
> > Fixes: 0aa31d7a5929 ("ip_frag: add IPv6 fragmentation support")
> > Cc: stable at dpdk.org
> >
> > Signed-off-by: Alexey Simakov <bigalex934 at gmail.com>
> 
> Acked-by: Konstantin Ananyev <konstantin.v.ananyev at yandex.ru>

Applied, thanks.