patch 'ip_frag: fix IPv6 fragmentation of short packets' has been queued to stable release 24.11.9

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/07/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/1bd3bf93b4fd2351ae6e9c6bc9cd3065698f3b7e

Thanks.

Luca Boccassi

---
>From 1bd3bf93b4fd2351ae6e9c6bc9cd3065698f3b7e Mon Sep 17 00:00:00 2001
From: Alexey Simakov <bigalex934 at gmail.com>
Date: Mon, 19 Oct 2026 13:13:33 +0300
Subject: [PATCH] ip_frag: fix IPv6 fragmentation of short packets

[ upstream commit 4a9ce38c891e91590b1a77ec3dff4e4581d8f8df ]

rte_ipv6_fragment_packet() does not check that the first mbuf segment
is large enough to hold the IPv6 header, unlike the IPv4 version,
which validates data_len against the header length.

With data_len < 40, in_seg_data_pos starts past the end of the
segment, the expression (in_seg->data_len - in_seg_data_pos)
underflows and the loop never advances to the next segment, so it
keeps producing fragments and writing past the end of pkts_out.

Reject such packets with -EINVAL, as rte_ipv4_fragment_packet() does.

Fixes: 0aa31d7a5929 ("ip_frag: add IPv6 fragmentation support")

Signed-off-by: Alexey Simakov <bigalex934 at gmail.com>
Acked-by: Konstantin Ananyev <konstantin.v.ananyev at yandex.ru>
---
 lib/ip_frag/rte_ipv6_fragmentation.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/ip_frag/rte_ipv6_fragmentation.c b/lib/ip_frag/rte_ipv6_fragmentation.c
index 56696f32f85..6fa6222a3d5 100644
--- a/lib/ip_frag/rte_ipv6_fragmentation.c
+++ b/lib/ip_frag/rte_ipv6_fragmentation.c
@@ -87,6 +87,14 @@ rte_ipv6_fragment_packet(struct rte_mbuf *pkt_in,
 	    unlikely(mtu_size < RTE_IPV6_MIN_MTU))
 		return -EINVAL;
 
+	/*
+	 * Check that the first segment is big enough to hold the IPv6
+	 * header; otherwise in_seg_data_pos starts past its end, the
+	 * difference below underflows and the loop never terminates.
+	 */
+	if (unlikely(pkt_in->data_len < sizeof(struct rte_ipv6_hdr)))
+		return -EINVAL;
+
 	/*
 	 * Ensure the IP payload length of all fragments (except the
 	 * last fragment) are a multiple of 8 bytes per RFC2460.
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-11-05 16:42:49.174254254 +0000
+++ 0111-ip_frag-fix-IPv6-fragmentation-of-short-packets.patch	2026-11-05 16:42:45.069065209 +0000
@@ -1 +1 @@
-From 4a9ce38c891e91590b1a77ec3dff4e4581d8f8df Mon Sep 17 00:00:00 2001
+From 1bd3bf93b4fd2351ae6e9c6bc9cd3065698f3b7e Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 4a9ce38c891e91590b1a77ec3dff4e4581d8f8df ]
+
@@ -18 +19,0 @@
-Cc: stable at dpdk.org
@@ -27 +28 @@
-index 86dd2e65ce7..791193f181f 100644
+index 56696f32f85..6fa6222a3d5 100644
@@ -30 +31 @@
-@@ -88,6 +88,14 @@ rte_ipv6_fragment_packet(struct rte_mbuf *pkt_in,
+@@ -87,6 +87,14 @@ rte_ipv6_fragment_packet(struct rte_mbuf *pkt_in,