From ea191bddafc272124ebb37906c41bbfa9ca5e21f Mon Sep 17 00:00:00 2001 From: Robert Lubos Date: Tue, 21 Jan 2025 14:48:50 +0100 Subject: [PATCH] net: pkt: Fix fixed buffer allocation with headroom bug The size calculation for the first buffer, in case extra headroom is requested, had a bug which could result in a size variable underflow followed by net_buf exhaustion. In case the net_buf size was larger than requested size, but smaller than requested size + headroom, the whole buffer size was subtracted from the requested size. This however did not take the extra headroom into account and in effect could result in underflow. Signed-off-by: Robert Lubos --- subsys/net/ip/net_pkt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/subsys/net/ip/net_pkt.c b/subsys/net/ip/net_pkt.c index 18afed972fe..6aa0ca91a10 100644 --- a/subsys/net/ip/net_pkt.c +++ b/subsys/net/ip/net_pkt.c @@ -970,7 +970,7 @@ static struct net_buf *pkt_alloc_buffer(struct net_pkt *pkt, size = 0U; } else { - size -= current->size; + size -= current->size - headroom; } } else { if (current->size > size) {