Linux 6.12-stable fixes packet TX ring overflow that can panic

Linux 6.12-stable is picking up a fix for an integer overflow in the AF_PACKET transmit ring path that lets a local user with CAP_NET_RAW force a kernel BUG, and a full panic on systems that treat oopses as fatal.

While draining SEND_REQUEST frames, the TX ring code adds each packet length into a signed integer total. Userspace may recycle completed frames while a blocking send is still running, so the accumulated byte count is not limited by ring size. After enough successful transmissions the sum wraps negative. One sequence of large frames produces a value the socket layer treats as an impossible return code and deliberately BUGs. Only CAP_NET_RAW is required.

Ilkka Lappeteläinen's change stops before the next frame would push the running total past INT_MAX, returning a short count and leaving the remaining frames for a later call. A two-thread TPACKET_V2 reproducer that previously oopsed on arm64 now completes cleanly. The flaw has been present since the original packet mmap TX_RING support was added.

Willem de Bruijn reviewed the fix; it is now queued for the 6.12 stable tree.