Re: [PATCH net] s390/qeth: validate user buffer length in SNMP and ARP query ioctls

[email protected] Tue, 04 Aug 2026 01:40:09 +0000

Newsgroups	org.kernel.vger.stable,org.kernel.vger.linux-kernel,org.kernel.vger.linux-s390,org.kernel.vger.netdev
Message-ID	<178580760915.2910544.4513512271107471606.git-patchwork-notify@kernel.org>

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

On Thu, 30 Jul 2026 16:22:16 +0200 you wrote:
> qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by
> a user-supplied length (udata_len) without checking a lower bound, then
> set udata_offset to a fixed non-zero value and pass both to a reply
> callback. The callback bounds-checks the copy with
> 
>         if ((udata_len - udata_offset) < len)
> 
> [...]

Here is the summary with links:
  - [net] s390/qeth: validate user buffer length in SNMP and ARP query ioctls
    https://git.kernel.org/netdev/net/c/d141f087b1af

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html