Hello: This series was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:
On Tue, 4 Aug 2026 14:28:34 +0900 you wrote: > An unprivileged user can oops the kernel by splicing into a kTLS socket > whose open record already has a full plaintext sk_msg ring. Reproduced on > net (53658c6f3682) with a stock config, no KASAN. > > Patch 2 oopses an unpatched kernel and passes with patch 1 applied. > > v2: > - fix the copy path so a full record is never left unpushed, rather than > making tls_sw_sendmsg_splice() tolerate a full ring (Sabrina) > - selftest: drop the comments, one splice instead of four, reuse a single > pipe, compare the whole blob, sweep 16..44 fragments > v1: > https://lore.kernel.org/netdev/[email protected]/ > > [...] Here is the summary with links: - [net,v2,1/2] tls: don't leave a full plaintext sk_msg ring unpushed https://git.kernel.org/netdev/net/c/7bca91d63341 - [net,v2,2/2] selftests: tls: add a test for splicing onto a full plaintext record https://git.kernel.org/netdev/net/c/3834e079d67f You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
