9560 IPv4 packets in IPv6 ethernet frames panic debug builds
Reviewed by: Jorge Schrauwen <jorge@blackdot.be>
Reviewed by: Igor Kozhukhov <igor@dilos.org>
Reviewed by: Toomas Soome <tsoome@me.com>
Reviewed by: Ken Mays <maybird1776@yahoo.com>
Approved by: Gordon Ross <gordon.w.ross@gmail.com>
re #10173, rb4465 VLAN fanout stuck to one CPU

@@ -1787,12 +1787,15 @@
                 /*
                  * Do src based fanout if below tunable is set to B_TRUE or
                  * when mac_ip_hdr_length_v6() fails because of malformed
                  * packets or because mblks need to be concatenated using
                  * pullupmsg().
+                 *
+                 * Perform a version check to prevent parsing weirdness...
                  */
-                if (!mac_ip_hdr_length_v6(ip6h, mp->b_wptr, &hdr_len, &nexthdr,
+                if (IPH_HDR_VERSION(ip6h) != IPV6_VERSION ||
+                    !mac_ip_hdr_length_v6(ip6h, mp->b_wptr, &hdr_len, &nexthdr,
                     NULL)) {
                         goto src_dst_based_fanout;
                 }
         } else {
                 hdr_len = IPH_HDR_LENGTH(ipha);