[PATCH] ipv6: fix payload_len inflation in ip6_xmit() when IPV6_RTHDRDSTOPTS is set without IPV6_RTHDR

[PATCH] ipv6: fix payload_len inflation in ip6_xmit() when IPV6_RTHDRDSTOPTS is set without IPV6_RTHDR

[Hui Peng]

When ipv6_fixup_options() was introduced to ignore destination options
before a routing header (opt->dst0opt) unless a routing header
(opt->srcrt) is also present, rawv6_sendmsg(), udpv6_sendmsg(), and
inet6_csk_xmit() were updated to normalize `opt` via
ipv6_fixup_options(), while other callers pass `np->opt` directly into
ip6_xmit() (such as tcp_v6_send_response(), sctp_v6_xmit(), and
l2tp_ip6_xmit()).

In ip6_xmit(), ipv6_push_nfrag_opts() only pushes opt->dst0opt into the
packet if opt->srcrt is non-NULL. However, ip6_xmit() unconditionally
adds opt->opt_nflen (which still includes ipv6_optlen(opt->dst0opt) if
__ipv6_fixup_options() was not called by the caller) to `seg_len` and
writes `hdr->payload_len = htons(seg_len)`. This causes the transmitted
IPv6 header's payload_len to exceed the actual packet payload by
ipv6_optlen(opt->dst0opt), causing receivers to drop the packet as
truncated.

Normalize `opt` with `__ipv6_fixup_options(&opt_space, opt)` at the
start of ip6_xmit() when `opt` is non-NULL.

Fixes: df9890c31a1a ("[IPV6]: Fix sending extension headers before and including routing header.")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 net/ipv6/ip6_output.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 550965058991..17d6add40864 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -295,6 +295,7 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
 	struct in6_addr *first_hop = &fl6->daddr;
 	struct dst_entry *dst = skb_dst(skb);
 	struct inet6_dev *idev = ip6_dst_idev(dst);
+	struct ipv6_txoptions opt_space;
 	struct net *net = sock_net(sk);
 	unsigned int head_room;
 	struct net_device *dev;
@@ -304,6 +305,9 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
 	int ret, hlimit = -1;
 	u32 mtu;
 
+	if (unlikely(opt))
+		opt = __ipv6_fixup_options(&opt_space, opt);
+
 	rcu_read_lock();
 
 	dev = dst_dev_rcu(dst);
-- 
2.55.0.1082.g2b9226bbc0-goog