[PATCH v2 0/2] net: clear IP defragmentation state after returning a complete packet

Mateusz Furdyna mateusz.furdyna at nokia.com
Wed Jun 10 16:25:32 CEST 2026


This series fixes incomplete clearing of the IP reassembly state
(CONFIG_IP_DEFRAG): the static counters and hole list are not reset after a
reassembled datagram is handed back to the caller. A duplicated final
fragment is then processed against stale state, mis-parsing the delivered
payload as the hole list, which can lead to re-delivery or out-of-bounds
accesses.

Patch 1 contains the fix and the full rationale; patch 2 adds a unit
test (run via "ut dm") that reproduces the duplicate-final-fragment
case and guards against regressions.

Signed-off-by: Mateusz Furdyna <mateusz.furdyna at nokia.com>
---
Changes in v2:
- correct spelling in commit msg "mistakingly" -> "mistakenly" 
- net.c: fix block comment formatting
- add regression test (net_defrag.c)
- Link to v1: https://lore.kernel.org/all/20260602-ip_defrag-v1-1-f4cc1265cc49@nokia.com

To: Ben Warren <biggerbadderben at gmail.com>
To: Alessandro Rubini <rubini-list at gnudd.com>
To: u-boot at lists.denx.de
Cc: Jerome Forissier <jerome.forissier at arm.com>
Cc: Tom Rini <trini at konsulko.com>
Cc: Andrew Goodbody <andrew.goodbody at linaro.org>
Cc: Max Merchel <Max.Merchel at ew.tq-group.com>
Cc: Yuya Hamamachi <yuya.hamamachi.sx at renesas.com>
Cc: Marek Vasut <marek.vasut+renesas at mailbox.org>
Cc: Mateusz Furdyna <mateusz.furdyna at nokia.com>
Cc: Quentin Schulz <quentin.schulz at cherry.de>
Cc: Alessandro Rubini <rubini at gnudd.com>
Cc: Simon Glass <sjg at chromium.org>
Cc: Dinesh Maniyam <dinesh.maniyam at altera.com>
Cc: Neil Armstrong <neil.armstrong at linaro.org>
Cc: Svyatoslav Ryhel <clamor95 at gmail.com>
Cc: Heiko Schocher <hs at nabladev.com>
Cc: "Lucien.Jheng" <lucienzx159 at gmail.com>
Cc: Rasmus Villemoes <ravi at prevas.dk>

---
Mateusz Furdyna (2):
      net: clear IP defragmentation state after returning a complete packet
      test: net: add IP defragmentation duplicate-fragment regression test

 net/net.c            |  9 ++++++
 test/dm/Makefile     |  1 +
 test/dm/net_defrag.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 92 insertions(+)
---
base-commit: 30b77f6aa146c96b831cb4ece038130b655b6a41
change-id: 20260530-ip_defrag-130c345dd9db

Best regards,
--  
Mateusz Furdyna <mateusz.furdyna at nokia.com>



More information about the U-Boot mailing list