af_rose/x25: Sanity check the maximum user frame size

Otherwise we can wrap the sizes and end up sending garbage.

Closes #10423

Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 6 insertions, 0 deletions

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 9ca17b1ce52e..ed80af8ca5fb 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1035,6 +1035,12 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock,
                 sx25.sx25_addr   = x25->dest_addr;
         }
 
+        /* Sanity check the packet size */
+        if (len > 65535) {
+                rc = -EMSGSIZE;
+                goto out;
+        }
+
         SOCK_DEBUG(sk, "x25_sendmsg: sendto: Addresses built.\n");
 
         /* Build a packet */