Re: [PATCH net v1] tls: device: fix out-of-bounds write in tls_append_frag()

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <[email protected]>:

On Sun, 23 Aug 2026 16:47:56 +0800 you wrote:
> Found with syzkaller and a local syzbot instance running on top of a
> netdevsim TLS offload emulation; tls_device.c is otherwise only reachable
> on a machine with a NIC that implements the offload.
> 
> tls_push_data() only checks whether the open record still has room for
> another frag at the bottom of its loop, and the MSG_MORE early break
> skips that check.  The record survives to the next syscall with the frag
> count it already had, and tls_append_frag() does not check either, so
> with TLS_TX_ZEROCOPY_RO every splice(SPLICE_F_MORE) of a byte or two adds
> a non-coalescing pipe page and num_frags walks off the end of
> tls_record_info.frags[MAX_SKB_FRAGS].  Once the record is pushed,
> tls_push_record() runs the same index over sg_tx_data[MAX_SKB_FRAGS] and
> the sg_set_page() writes land on the destruct_work that follows it, which
> the workqueue then calls.
> 
> [...]

Here is the summary with links:
  - [net,v1] tls: device: fix out-of-bounds write in tls_append_frag()
    https://git.kernel.org/netdev/net/c/b17cf742eaad

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html