ipv6: account for jumbo payload option

[tuexen]

Summary

If a jumbo payload option is added, the length of the mbuf chain is increased by 8 but the actual hop-by-hop extension header with the jumbo playload option is only inserted in the packet if there are other options. Therefore, adjust optlen to reflect the actual size of IPv6 extension headers including the hop-by-hop extension header containing the jumbo payload option.

Reported-by: [e-mail]

[markj]

sys/netinet6/ip6_output.c

559

I don't really understand this. We already added optlen to m->m_pkthdr.len above. Why don't we need to do that for a lone jumbo header?

[tuexen]

sys/netinet6/ip6_output.c

559

Because if optlen is zero, we don't put the actual header in place. The hop-by-hop extension header is put in place in line ip6_output.c#n601, which is protected by optlen > 0 in ip6_output.c#n563.
A correct value of optlen is also crucial for the checksum computation in ip6_output.c:1141. This is where syzcaller was triggering a panic.

[markj]

sys/netinet6/ip6_output.c

559

Because if optlen is zero, we don't put the actual header in place. The hop-by-hop extension header is put in place in line ip6_output.c#n601, which is protected by optlen > 0 in ip6_output.c#n563.

I understand, I'm asking about the code on line 542.

[tuexen]

sys/netinet6/ip6_output.c

559

Because optlen does not include the jumbo payload option at the time of the increment of m_pkthdr.len. The 8 bytes are added later to m_pkthdr.len in ip6_insert_jumboopt() in line 1396. This means without this patch, optlen never includes the jumbo payload option, but m_pkthdr.len does, if the jumbo payload option should be included. However, it is only included, if optlen is positive. This results in the situation, where m_pkthdr.len indicates 8 more bytes than they are actually in the mbuf chain, since the hop-by-hop option was never inserted.

[timo.voelker_fh-muenster.de]

I agree @markj. It is not easy to understand the code. However, before this patch, without any other options, optlen is 0 and, thus, the jumbo option will never be added.

This patch fixes the bug. Making the code more readable might make sense, but I would separate that from this patch.

[markj]

I suspect we should move the optlen value into struct ip6_exthdrs, and update it directly in ip6_insert_jumboopt().