diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 8fc30467d3f53..f09a8c64ee2fe 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -1448,7 +1448,8 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile, int err; int i; - if (it->nr_segs > MAX_SKB_FRAGS + 1) + if (it->nr_segs > MAX_SKB_FRAGS + 1 || + len > (ETH_MAX_MTU - NET_SKB_PAD - NET_IP_ALIGN)) return ERR_PTR(-EMSGSIZE); local_bh_disable();