Re: [PATCH net] s390/qeth: validate user buffer length in SNMP and ARP query ioctls

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Thu, 30 Jul 2026 16:22:16 +0200 you wrote:
> qeth_snmp_command() and qeth_l3_arp_query() allocate a buffer sized by
> a user-supplied length (udata_len) without checking a lower bound, then
> set udata_offset to a fixed non-zero value and pass both to a reply
> callback. The callback bounds-checks the copy with
> 
>         if ((udata_len - udata_offset) < len)
> 
> [...]

Here is the summary with links:
  - [net] s390/qeth: validate user buffer length in SNMP and ARP query ioctls
    https://git.kernel.org/netdev/net/c/d141f087b1af

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html