From: patchwork-bot+netdevbpf@kernel.org
To: =?utf-8?q?Ilkka_Lappetel=C3=A4inen_=3Cilkka=2Elappetelainen=40gmail=2Ecom=3E?=@aws-us-west-2-korg-oddjob-rhel9-1.codeaurora.org
Cc: willemdebruijn.kernel@gmail.com, netdev@vger.kernel.org,
security@kernel.org
Subject: Re: [PATCH net] net/packet: prevent TX_RING byte count overflow
Date: Tue, 29 Sep 2026 23:50:04 +0000 [thread overview]
Message-ID: <179072580454.1169866.3216258817099435365.git-patchwork-notify@kernel.org> (raw)
In-Reply-To: <20260925124829.6595-1-ilkka.lappetelainen@gmail.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 25 Sep 2026 15:48:29 +0300 you wrote:
> tpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds
> each valid packet length to the signed int len_sum. Userspace can
> recycle completed frames concurrently, so a single blocking send call
> is not bounded by the ring size.
>
> After enough successful transmissions len_sum wraps into the negative
> range. In particular, 65536 65535-byte frames followed by a 65007-byte
> frame produce 0xfffffdef, or -EIOCBQUEUED. sock_sendmsg_nosec() treats
> that as an impossible return and triggers a BUG. On systems configured
> to panic on oops, a CAP_NET_RAW holder can panic the host kernel.
>
> [...]
Here is the summary with links:
- [net] net/packet: prevent TX_RING byte count overflow
https://git.kernel.org/netdev/net/c/2cf81fc9505b
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
prev parent reply other threads:[~2026-09-29 23:50 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-25 12:48 [PATCH net] net/packet: prevent TX_RING byte count overflow Ilkka Lappeteläinen
2026-09-27 20:37 ` Willem de Bruijn
2026-09-29 23:50 ` patchwork-bot+netdevbpf [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=179072580454.1169866.3216258817099435365.git-patchwork-notify@kernel.org \
--to=patchwork-bot+netdevbpf@kernel.org \
--cc==?utf-8?q?Ilkka_Lappetel=C3=A4inen_=3Cilkka=2Elappetelainen=40gmail=2Ecom=3E?=@aws-us-west-2-korg-oddjob-rhel9-1.codeaurora.org \
--cc=netdev@vger.kernel.org \
--cc=security@kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox