From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E78533783C7 for ; Tue, 7 Jul 2026 15:05:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783436702; cv=none; b=OJyf4fIe5lcP4IyqCR1vadE/c3f3iFXI1E6eq8GVgJZkvEt+4q9rPl+IUF03jqbQ8FZDBCfx4E4rN2udXPJPPfadzazGICIgq5kRdAMEGZ/SjqdlsjnDxFBiLyr/F446J8+4eKvmZO10ZUcidX6MXFOXX8C72w90Nacy+ZhTD5Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783436702; c=relaxed/simple; bh=L1Gp7wXlFQEuPv2KzkUnD8BSceJ0efg3rtA92dEaN64=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=isnerhdTnKBorKutSOKqRAEKwImD1O06CMbhyUqFwBDo5t40BYIeh+7UERDSXTXcVPN3cfKXcZUPYtIegf9bNJ9SIAXW2rKmzd9SvxS1iPK3QSnu4WWQEgbl5+RvL96fCmrBWiiIkHctTRAmvEZNaXq9A6GGs6vtDqryv+dQTdo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TKNZIS8I; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TKNZIS8I" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2caced6038eso9825815ad.0 for ; Tue, 07 Jul 2026 08:05:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783436700; x=1784041500; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=D/b2bMgyOi8gQBxNeyPHX8bFUkpJq0kBzVbli8MFshg=; b=TKNZIS8IroXeRqcBfZPHcsSjJQHTsYPSw+gX2R0VR43urQPjzbdJCC9WrSixgZ1a7z ATcSKA8mxkrpUvnpkGqL9bxxOPWAZ7ST9gw9TvvcgJ0o2a5SEl3X53clS8YAihEa6QFe 1hkheSI++JIHHhPeIpOSInqLDoF3xrfuzd3vF2rgrIssaC7hvH1w0K/c2VuF7ugHg3lY B52s5fCltQo2XlB5RXFlw6Kx4JcDW17CH3hofs4px4hYgH7+uwKNe9p6KyAUiSxF8pXv z/YtjFT4A+/9cB2btcdOv6SZgTgfFwDEIMP7W7obMW4TvHt36xIk29hRvIlu2BBIO5B1 6GaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783436700; x=1784041500; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=D/b2bMgyOi8gQBxNeyPHX8bFUkpJq0kBzVbli8MFshg=; b=n4MptWeXOs2ReG+DJLQW6ZsWWvbWBlHE1MFUqAKnTqc/IQI6VJFdhFVPMSKPjlefNo RzITREHNhfrq7XxG8dIuJypbqSLFw4jwqp9y8gizBn5e3l9ap4kFhuW2rSXTNv+j0m+b shaT5iNRLWHy5RMFoTiPhOsFTbXQ6/v5xgm3imzzErWd8X5K4VC6BQEHDD+bTVI/+0EG Jh/rsQ3a9rSiGQaehimLjxRnqlHrLpgXBm+09TVCKu1wgJwLa9FyPWxHLcW7NBFYPeke 2G6SfpgAa2ryl8/a40x6VV5Y9CuLA4mksXJ+/tJLVgifWsYERBVlttyydEjMAM9maQKz wymw== X-Forwarded-Encrypted: i=1; AHgh+Rqym9ql9Gf79qGnboZOwNlwR4YZtUeF1ruQiTAaTIowiCbJoUjOtfp9CqHqjaIl1RgsYinx4qGZEP5LyaM=@vger.kernel.org X-Gm-Message-State: AOJu0YzpFwyo3qonBp6Z8RPB/ELQXdPuZjkCiZd9BI8HDmiTwaR6JHEe W8S+LK/GnUaJS84ZMKunXwaSPyFWbXF+4g9INnRDvsws4cKVUq7KufYC X-Gm-Gg: AfdE7cnQmXKvqwhctXGdZbWvBM32RjYqfnYY4n3szcNG94RgK2zZB2JfNW8m91hIEvQ Bd6nHFOW/lJnp4kO+OFizXDm3TQrLUkVWbGi2zJi/AJjusEgu6dqOMNKrud7DTzhEoerV+n9E8i OK9UF0Rk5bSRllioaRG4HBkEMPFQ1XjazTg1xLBilgy5aSl8OGIgEsTtIJnRgkt6MP/syjPkS67 dWZLXl5ZxuA5eNK3OaiN5X/8hmQKxrj5JFE8MumhMU0MtDKpiSU2txFpLoxp3E7A1FCzWJzFVvv i7xOhOsW1Lg0yjkK6FSLUV5h2Q4MI0QfcHZ04cErIROy2wBqAn5fMFSKt98psq8W2CsQFUTRLIW WOXqJnDtXfn0ghW426fqPDvjqNI5gyam62IIX7lrG9GoIH3RkVDA+q4Y0toLOHstNU5FrbI2VRK RH4eteAHW4VkGsQqjETPSkTIHV6332iMdW X-Received: by 2002:a17:903:2ca:b0:2c9:fc4c:8142 with SMTP id d9443c01a7336-2ccca8e6a6amr27407265ad.2.1783436699735; Tue, 07 Jul 2026 08:04:59 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:239e:a31b:1d0d:374f]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9d3c99fsm13678625ad.68.2026.07.07.08.04.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2026 08:04:59 -0700 (PDT) From: Ruoyu Wang To: o-takashi@sakamocchi.jp Cc: fenlason@redhat.com, stefanr@s5r6.in-berlin.de, linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH] firewire: net: Fix fragmented datagram reassembly Date: Tue, 7 Jul 2026 23:04:54 +0800 Message-ID: <20260707150454.2265951-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit fwnet_frag_new() keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment also closes the gap to the next or previous list entry. Those neighbor lookups currently assume that the current fragment always has a real next or previous fragment. At a list edge, the next or previous entry is the list head, not a struct fwnet_fragment_info. The gap checks also compare against the old edge of the current fragment instead of the edge after adding the new fragment. As a result, a fragment that bridges two existing ranges may leave two adjacent ranges unmerged, so fwnet_pd_is_complete() can miss a complete datagram. Check for the list head before looking up the neighboring fragment, and compare the neighbor against the new fragment's far edge when deciding whether to merge all three ranges. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: c76acec6d551 ("firewire: add IPv4 support") Signed-off-by: Ruoyu Wang --- drivers/firewire/net.c | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c index e5361f4f8bbd9..961f1a0460257 100644 --- a/drivers/firewire/net.c +++ b/drivers/firewire/net.c @@ -297,31 +297,34 @@ static struct fwnet_fragment_info *fwnet_frag_new( if (fi->offset + fi->len == offset) { /* The new fragment can be tacked on to the end */ /* Did the new fragment plug a hole? */ - fi2 = list_entry(fi->fi_link.next, - struct fwnet_fragment_info, fi_link); - if (fi->offset + fi->len == fi2->offset) { - /* glue fragments together */ - fi->len += len + fi2->len; - list_del(&fi2->fi_link); - kfree(fi2); - } else { - fi->len += len; + if (!list_is_last(&fi->fi_link, &pd->fi_list)) { + fi2 = list_next_entry(fi, fi_link); + if (offset + len == fi2->offset) { + /* glue fragments together */ + fi->len += len + fi2->len; + list_del(&fi2->fi_link); + kfree(fi2); + + return fi; + } } + fi->len += len; return fi; } if (offset + len == fi->offset) { /* The new fragment can be tacked on to the beginning */ /* Did the new fragment plug a hole? */ - fi2 = list_entry(fi->fi_link.prev, - struct fwnet_fragment_info, fi_link); - if (fi2->offset + fi2->len == fi->offset) { - /* glue fragments together */ - fi2->len += fi->len + len; - list_del(&fi->fi_link); - kfree(fi); - - return fi2; + if (!list_is_first(&fi->fi_link, &pd->fi_list)) { + fi2 = list_prev_entry(fi, fi_link); + if (fi2->offset + fi2->len == offset) { + /* glue fragments together */ + fi2->len += fi->len + len; + list_del(&fi->fi_link); + kfree(fi); + + return fi2; + } } fi->offset = offset; fi->len += len; -- 2.51.0