[PATCH v2 0/2] net: fix out-of-bounds write in IP fragment reassembly

This fixes an out-of-bounds write in IP fragment reassembly and adds a
regression test.

__net_defragment() writes an 8-byte hole descriptor that can land past
the end of the static reassembly buffer when a fragment with a non-zero
offset and the More-Fragments flag set is received during netboot. It is
reachable on the local network segment while the device is in a receive
loop (dhcp/tftp/nfs/ping). Patch 1 adds the bounds check; patch 2 adds a
DM test that reproduces the overflow.

Based on v2026.07 (fdfe2ec48d5c).

Signed-off-by: Shahriyar Jalayeri <[email protected]>
---
Changes in v2:
- Use my real name in the From and Signed-off-by (Jerome Forissier)

---
Shahriyar Jalayeri (2):
      net: fix out-of-bounds write in IP fragment reassembly
      test: net: add regression test for IP reassembly overflow

 net/net.c            |  4 ++++
 test/dm/net_defrag.c | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)
---
base-commit: fdfe2ec48d5c1c2ed03073d73edd3fdd3fe1ffa1
change-id: 20260722-net-oob-fix-4b8fc8adeec6

Best regards,
--  
Shahriyar Jalayeri <[email protected]>