This series fixes incomplete clearing of the IP reassembly state (CONFIG_IP_DEFRAG): the static counters and hole list are not reset after a reassembled datagram is handed back to the caller. A duplicated final fragment is then processed against stale state, mis-parsing the delivered payload as the hole list, which can lead to re-delivery or out-of-bounds accesses.
Patch 1 contains the fix and the full rationale; patch 2 adds a unit test (run via "ut dm") that reproduces the duplicate-final-fragment case and guards against regressions. Signed-off-by: Mateusz Furdyna <[email protected]> --- Changes in v2: - correct spelling in commit msg "mistakingly" -> "mistakenly" - net.c: fix block comment formatting - add regression test (net_defrag.c) - Link to v1: https://lore.kernel.org/all/[email protected] To: Ben Warren <[email protected]> To: Alessandro Rubini <[email protected]> To: [email protected] Cc: Jerome Forissier <[email protected]> Cc: Tom Rini <[email protected]> Cc: Andrew Goodbody <[email protected]> Cc: Max Merchel <[email protected]> Cc: Yuya Hamamachi <[email protected]> Cc: Marek Vasut <[email protected]> Cc: Mateusz Furdyna <[email protected]> Cc: Quentin Schulz <[email protected]> Cc: Alessandro Rubini <[email protected]> Cc: Simon Glass <[email protected]> Cc: Dinesh Maniyam <[email protected]> Cc: Neil Armstrong <[email protected]> Cc: Svyatoslav Ryhel <[email protected]> Cc: Heiko Schocher <[email protected]> Cc: "Lucien.Jheng" <[email protected]> Cc: Rasmus Villemoes <[email protected]> --- Mateusz Furdyna (2): net: clear IP defragmentation state after returning a complete packet test: net: add IP defragmentation duplicate-fragment regression test net/net.c | 9 ++++++ test/dm/Makefile | 1 + test/dm/net_defrag.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 92 insertions(+) --- base-commit: 30b77f6aa146c96b831cb4ece038130b655b6a41 change-id: 20260530-ip_defrag-130c345dd9db Best regards, -- Mateusz Furdyna <[email protected]>
