Re: [PATCH net-next] net: downgrade BUG_ON EIOCBQUEUED in sock_sendmsg_nosec

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This patch was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Sun, 27 Sep 2026 22:03:29 -0400 you wrote:
> From: Willem de Bruijn <willemb@google.com>
> 
> sock_sendmsg_nosec() runs in syscall context but calls BUG_ON() if
> proto_ops->sendmsg() returns -EIOCBQUEUED. Crashing the kernel on an
> unexpected return value is dangerous for production workloads.
> 
> This risk is real: any signed integer overflow in a sendmsg handler
> that returns 0xfffffdef (-529, -EIOCBQUEUED) triggers this BUG_ON. In
> one month, two such bugs were reported in PF_PACKET, reachable by
> a local user with CAP_NET_RAW in a user namespace:
> - Commit 73e594c19b4f ("af_packet: Don't cast tpacket_hdr.tp_len to int
>   in tpacket_parse_header().")
> - In review ("net/packet: prevent TX_RING byte count overflow")
>   https://lore.kernel.org/netdev/20260925124829.6595-1-ilkka.lappetelainen@gmail.com/
> 
> [...]

Here is the summary with links:
  - [net-next] net: downgrade BUG_ON EIOCBQUEUED in sock_sendmsg_nosec
    https://git.kernel.org/netdev/net-next/c/ee1972def665

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html