20/10/2026 10:01, Konstantin Ananyev:
>
> > rte_ipv6_fragment_packet() does not check that the first mbuf segment
> > is large enough to hold the IPv6 header, unlike the IPv4 version,
> > which validates data_len against the header length.
> >
> > With data_len < 40, in_seg_data_pos starts past the end of the
> > segment, the expression (in_seg->data_len - in_seg_data_pos)
> > underflows and the loop never advances to the next segment, so it
> > keeps producing fragments and writing past the end of pkts_out.
> >
> > Reject such packets with -EINVAL, as rte_ipv4_fragment_packet() does.
> >
> > Fixes: 0aa31d7a5929 ("ip_frag: add IPv6 fragmentation support")
> > Cc: [email protected]
> >
> > Signed-off-by: Alexey Simakov <[email protected]>
>
> Acked-by: Konstantin Ananyev <[email protected]>
Applied, thanks.
