diff --git a/fragmentation.c b/fragmentation.c index 362e91a..f733b99 100644 --- a/fragmentation.c +++ b/fragmentation.c @@ -249,6 +249,24 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb) skb_out = entry->skb; kfree(entry); + if (size < skb->len) { + printk(KERN_DEBUG "batadv_frag_merge_packets: skb total size too small: size=%i, skb->len=%u\n", + size, skb->len); + print_hex_dump_bytes("", DUMP_PREFIX_NONE, skb->data - ETH_HLEN, + ETH_HLEN + hdr_size + 16); + + goto free; + } + + if (size < skb_out->len) { + printk(KERN_DEBUG "batadv_frag_merge_packets: skb_out total size too small: size=%i, skb_out->len=%u\n", + size, skb_out->len); + print_hex_dump_bytes("", DUMP_PREFIX_NONE, skb_out->data - ETH_HLEN, + ETH_HLEN + hdr_size + 16); + + goto free; + } + /* Make room for the rest of the fragments. */ if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) { kfree_skb(skb_out);