diff --git a/drivers/net/tun.c b/drivers/net/tun.c index f92d6a12831f..9909f430d723 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -1445,7 +1445,8 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile, int err; int i; - if (it->nr_segs > MAX_SKB_FRAGS + 1) + if (it->nr_segs > MAX_SKB_FRAGS + 1 || + len > (ETH_MAX_MTU - NET_SKB_PAD - NET_IP_ALIGN)) return ERR_PTR(-EMSGSIZE); local_bh_disable();