Re: [PATCH net v2 0/2] tls: fix plaintext sk_msg ring over-fill

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

On Tue,  4 Aug 2026 14:28:34 +0900 you wrote:
> An unprivileged user can oops the kernel by splicing into a kTLS socket
> whose open record already has a full plaintext sk_msg ring.  Reproduced on
> net (53658c6f3682) with a stock config, no KASAN.
> 
> Patch 2 oopses an unpatched kernel and passes with patch 1 applied.
> 
> v2:
>   - fix the copy path so a full record is never left unpushed, rather than
>     making tls_sw_sendmsg_splice() tolerate a full ring (Sabrina)
>   - selftest: drop the comments, one splice instead of four, reuse a single
>     pipe, compare the whole blob, sweep 16..44 fragments
> v1: https://lore.kernel.org/netdev/[email protected]/
> 
> [...]

Here is the summary with links:
  - [net,v2,1/2] tls: don't leave a full plaintext sk_msg ring unpushed
    https://git.kernel.org/netdev/net/c/7bca91d63341
  - [net,v2,2/2] selftests: tls: add a test for splicing onto a full plaintext record
    https://git.kernel.org/netdev/net/c/3834e079d67f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html