Re: [PATCH] net: hinic: fix mailbox segment buffer overflow

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Mon,  7 Sep 2026 02:42:34 +0000 you wrote:
> check_mbox_seq_id_and_seg_len() validates that seq_id does not
> exceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed
> MBOX_SEG_LEN (48).  However, this allows the last segment
> (seq_id=42) to carry a full 48-byte payload, writing to offset
> 42*48=2016 for 48 bytes (ending at byte 2064).  The receive
> buffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a
> 16-byte heap buffer overflow.
> 
> [...]

Here is the summary with links:
  - net: hinic: fix mailbox segment buffer overflow
    https://git.kernel.org/netdev/net/c/5d4d98595743

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html