Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski [off-list ref]:
On Tue, 20 Oct 2026 17:42:49 +0800 you wrote:
From: Liu Chao <redacted>
ipc_protocol_free_msg_get() reads msg_head from shared memory and
uses it directly as an index into msg_ring[]. If the head is out
of range, the subsequent memset() writes beyond the message ring.
Validate head against IPC_MEM_MSG_ENTRIES before using it as an
index. The ring is a circular buffer, so a value outside the valid
range indicates a corrupted head pointer; report the error and fail
the allocation instead of writing out of bounds.
[...]
Here is the summary with links:
- net: wwan: iosm: validate msg_head before indexing msg_ring
https://git.kernel.org/netdev/net-next/c/46cbf85155e5
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html