[PATCH] ip_frag: fix IPv6 fragmentation of short packets

[PATCH] ip_frag: fix IPv6 fragmentation of short packets

[Alexey Simakov]

rte_ipv6_fragment_packet() does not check that the first mbuf segment
is large enough to hold the IPv6 header, unlike the IPv4 version,
which validates data_len against the header length.

With data_len < 40, in_seg_data_pos starts past the end of the
segment, the expression (in_seg->data_len - in_seg_data_pos)
underflows and the loop never advances to the next segment, so it
keeps producing fragments and writing past the end of pkts_out.

Reject such packets with -EINVAL, as rte_ipv4_fragment_packet() does.

Fixes: 0aa31d7a5929 ("ip_frag: add IPv6 fragmentation support")
Cc: stable@dpdk.org

Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
---
 lib/ip_frag/rte_ipv6_fragmentation.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/ip_frag/rte_ipv6_fragmentation.c b/lib/ip_frag/rte_ipv6_fragmentation.c
index c81f2402e3..fac72f84d2 100644
--- a/lib/ip_frag/rte_ipv6_fragmentation.c
+++ b/lib/ip_frag/rte_ipv6_fragmentation.c
@@ -89,6 +89,14 @@ rte_ipv6_fragment_packet(struct rte_mbuf *pkt_in,
 	    unlikely(mtu_size < RTE_IPV6_MIN_MTU))
 		return -EINVAL;
 
+	/*
+	 * Check that the first segment is big enough to hold the IPv6
+	 * header; otherwise in_seg_data_pos starts past its end, the
+	 * difference below underflows and the loop never terminates.
+	 */
+	if (unlikely(pkt_in->data_len < sizeof(struct rte_ipv6_hdr)))
+		return -EINVAL;
+
 	/*
 	 * Ensure the IP payload length of all fragments (except the
 	 * last fragment) are a multiple of 8 bytes per RFC2460.
-- 
2.53.0

Re: [PATCH] ip_frag: fix IPv6 fragmentation of short packets

[Konstantin Ananyev]

> rte_ipv6_fragment_packet() does not check that the first mbuf segment
> is large enough to hold the IPv6 header, unlike the IPv4 version,
> which validates data_len against the header length.
>
> With data_len < 40, in_seg_data_pos starts past the end of the
> segment, the expression (in_seg->data_len - in_seg_data_pos)
> underflows and the loop never advances to the next segment, so it
> keeps producing fragments and writing past the end of pkts_out.
>
> Reject such packets with -EINVAL, as rte_ipv4_fragment_packet() does.
>
> Fixes: 0aa31d7a5929 ("ip_frag: add IPv6 fragmentation support")
> Cc: stable@dpdk.org
>
> Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
> ---
>   lib/ip_frag/rte_ipv6_fragmentation.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
>
> diff --git a/lib/ip_frag/rte_ipv6_fragmentation.c b/lib/ip_frag/rte_ipv6_fragmentation.c
> index c81f2402e3..fac72f84d2 100644
> --- a/lib/ip_frag/rte_ipv6_fragmentation.c
> +++ b/lib/ip_frag/rte_ipv6_fragmentation.c
> @@ -89,6 +89,14 @@ rte_ipv6_fragment_packet(struct rte_mbuf *pkt_in,
>   	    unlikely(mtu_size < RTE_IPV6_MIN_MTU))
>   		return -EINVAL;
>   
> +	/*
> +	 * Check that the first segment is big enough to hold the IPv6
> +	 * header; otherwise in_seg_data_pos starts past its end, the
> +	 * difference below underflows and the loop never terminates.
> +	 */
> +	if (unlikely(pkt_in->data_len < sizeof(struct rte_ipv6_hdr)))
> +		return -EINVAL;
> +
>   	/*
>   	 * Ensure the IP payload length of all fragments (except the
>   	 * last fragment) are a multiple of 8 bytes per RFC2460.

Acked-by: Konstantin Ananyev <konstantin.v.ananyev@yandex.ru>