[nrf fromtree] net: pkt: Fix fixed buffer allocation with headroom bug

rlubos · nordicjm · commit 81eaa466f869 · 2025-04-14T11:19:17.000+01:00
The size calculation for the first buffer, in case extra headroom is requested, had a bug which could result in a size variable underflow followed by net_buf exhaustion. In case the net_buf size was larger than requested size, but smaller than requested size + headroom, the whole buffer size was subtracted from the requested size. This however did not take the extra headroom into account and in effect could result in underflow. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no> (cherry picked from commit ea191bd)
diff --git a/subsys/net/ip/net_pkt.c b/subsys/net/ip/net_pkt.c
@@ -970,7 +970,7 @@ static struct net_buf *pkt_alloc_buffer(struct net_pkt *pkt,
 
 				size = 0U;
 			} else {
-				size -= current->size;
+				size -= current->size - headroom;
 			}
 		} else {
 			if (current->size > size) {

Original file line number	Diff line number	Diff line change
`@@ -970,7 +970,7 @@ static struct net_buf pkt_alloc_buffer(struct net_pkt pkt,`
`970`	`970`
`971`	`971`	`size = 0U;`
`972`	`972`	`} else {`
`973`		`- size -= current->size;`
	`973`	`+ size -= current->size - headroom;`
`974`	`974`	`}`
`975`	`975`	`} else {`
`976`	`976`	`if (current->size > size) {`