Re: [PATCH] net/ipv6: ioam6: prevent schema length wraparound in trace fill

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by David S. Miller <davem@xxxxxxxxxxxxx>:

On Wed, 25 Mar 2026 15:41:52 +0800 you wrote:
> ioam6_fill_trace_data() stores the schema contribution to the trace
> length in a u8. With bit 22 enabled and the largest schema payload,
> sclen becomes 1 + 1020 / 4, wraps from 256 to 0, and bypasses the
> remaining-space check. __ioam6_fill_trace_data() then positions the
> write cursor without reserving the schema area but still copies the
> 4-byte schema header and the full schema payload, overrunning the trace
> buffer.
> 
> [...]

Here is the summary with links:
  - net/ipv6: ioam6: prevent schema length wraparound in trace fill
    https://git.kernel.org/netdev/net/c/5e67ba9bb531

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html