Re: [PATCH] ipv6: fix payload_len inflation in ip6_xmit() when IPV6_RTHDRDSTOPTS is set without IPV6_RTHDR

[Paolo Abeni <pabeni@redhat.com>]

On 9/19/26 23:06, Hui Peng wrote:
> When ipv6_fixup_options() was introduced to ignore destination options
> before a routing header (opt->dst0opt) unless a routing header
> (opt->srcrt) is also present, rawv6_sendmsg(), udpv6_sendmsg(), and
> inet6_csk_xmit() were updated to normalize `opt` via
> ipv6_fixup_options(), while other callers pass `np->opt` directly into
> ip6_xmit() (such as tcp_v6_send_response(), sctp_v6_xmit(), and
> l2tp_ip6_xmit()).
> 
> In ip6_xmit(), ipv6_push_nfrag_opts() only pushes opt->dst0opt into the
> packet if opt->srcrt is non-NULL. However, ip6_xmit() unconditionally
> adds opt->opt_nflen (which still includes ipv6_optlen(opt->dst0opt) if
> __ipv6_fixup_options() was not called by the caller) to `seg_len` and
> writes `hdr->payload_len = htons(seg_len)`. This causes the transmitted
> IPv6 header's payload_len to exceed the actual packet payload by
> ipv6_optlen(opt->dst0opt), causing receivers to drop the packet as
> truncated.

Are there any in tree call site leading to the above? If so I think
we are better of calling __ipv6_fixup_options() there instead of
adding more conditionals in the fastpath.

/P