Re: [PATCH net] net/smc: queue the copied chunk when smc_tx_sendmsg() faults

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Tue, 13 Oct 2026 15:45:01 -0500 you wrote:
> From: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
> 
> When a send wraps the end of the send buffer, smc_tx_sendmsg() copies
> the data in two chunks. If memcpy_from_msg() faults on the second one,
> smc_tx_sendmsg() returns send_done, which already counts the first
> chunk, but leaves tx_curs_prep and sndbuf_space as they were. send()
> reports bytes the peer never receives, and the next send() overwrites
> them. Any caller can hit this on its own stream with a buffer whose
> tail is unreadable.
> 
> [...]

Here is the summary with links:
  - [net] net/smc: queue the copied chunk when smc_tx_sendmsg() faults
    https://git.kernel.org/netdev/net/c/c0703534b223

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html