[PATCH net v2] net/x25: Fix overflow when accumulating packets
From: Martin Schiller <ms@dev.tdt.de>
Date: 2026-03-27 08:49:13
Also in:
lkml
Subsystem:
networking [general], the rest, x.25 stack · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds, Martin Schiller
Add a check to ensure that `x25_sock.fraglen` does not overflow. The `fraglen` also needs to be resetted when purging `fragment_queue` in `x25_clear_queues()`. Reported-by: Yiming Qian <redacted> Signed-off-by: Martin Schiller <ms@dev.tdt.de> --- Changes in v2: - Use USHRT_MAX instead of sizeof(fraglen) nonsense - Link to v1: https://lore.kernel.org/r/20260327-x25_fraglen-v1-1-9fc751d4f754@dev.tdt.de (local) --- net/x25/x25_in.c | 6 ++++++ net/x25/x25_subr.c | 1 + 2 files changed, 7 insertions(+)
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index b981a4828d08c2e6676749a06035910eab01e6cd..cb84c683d249d6078f3673835bb2f80eb487f253 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c@@ -34,6 +34,12 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more) struct sk_buff *skbo, *skbn = skb; struct x25_sock *x25 = x25_sk(sk); + /* make sure we don't overflow */ + if (x25->fraglen + skb->len > USHRT_MAX) { + kfree_skb(skb); + return 1; + } + if (more) { x25->fraglen += skb->len; skb_queue_tail(&x25->fragment_queue, skb);
diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
index 0285aaa1e93c17233748d38eef6d8b5c6059b67a..159708d9ad20cb2e6db24ead67daf1e9d6258f64 100644
--- a/net/x25/x25_subr.c
+++ b/net/x25/x25_subr.c@@ -40,6 +40,7 @@ void x25_clear_queues(struct sock *sk) skb_queue_purge(&x25->interrupt_in_queue); skb_queue_purge(&x25->interrupt_out_queue); skb_queue_purge(&x25->fragment_queue); + x25->fraglen = 0; }
--- base-commit: 4ae97cae07e15d41e5c0ebabba64c6eefdeb0bbe change-id: 20260325-x25_fraglen-8fc240d1edd3 Best regards, -- Martin Schiller [off-list ref]