This fixes an out-of-bounds write in IP fragment reassembly and adds a regression test.
__net_defragment() writes an 8-byte hole descriptor that can land past the end of the static reassembly buffer when a fragment with a non-zero offset and the More-Fragments flag set is received during netboot. It is reachable on the local network segment while the device is in a receive loop (dhcp/tftp/nfs/ping). Patch 1 adds the bounds check; patch 2 adds a DM test that reproduces the overflow. Based on v2026.07 (fdfe2ec48d5c). Signed-off-by: shj <[email protected]> --- shj (2): net: fix out-of-bounds write in IP fragment reassembly test: net: add regression test for IP reassembly overflow net/net.c | 4 ++++ test/dm/net_defrag.c | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+) --- base-commit: fdfe2ec48d5c1c2ed03073d73edd3fdd3fe1ffa1 change-id: 20260722-net-oob-fix-4b8fc8adeec6 Best regards, -- shj <[email protected]>
