Re: [PATCH wireless 1/1] wifi: mac80211: fix fragment length overflow

[Johannes Berg <johannes@sipsolutions.net>]

On Sat, 2026-08-29 at 13:36 +0800, Zhiling Zou wrote:
> The fragment reassembly cache tracks the amount of data in continuation
> fragments in a u16. An oversized fragmented frame can therefore wrap the
> value before it is passed to pskb_expand_head(), leaving the destination
> skb too small for the queued fragments and triggering skb_over_panic().
> 
> Use an unsigned int, matching skb->len, so the accumulator is not
> truncated at 16 bits.
> 
> Fixes: 3a11ce08c45b ("mac80211: add fragment cache to sta_info")
> Cc: stable@vger.kernel.org

I'm not sure this is reachable in real hardware - there are PHY limits
on frame sizes too... it might be though with VHT or so?

> +++ b/net/mac80211/sta_info.h
> @@ -458,7 +458,7 @@ struct ieee80211_fragment_entry {
>  	struct sk_buff_head skb_list;
>  	unsigned long first_frag_time;
>  	u16 seq;
> -	u16 extra_len;
> +	unsigned int extra_len;
>  	u16 last_frag;

You could reorder the fields to not add holes, especially if you're
fixing a patch that as trying to make this smaller ...

johannes