Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski [off-list ref]:
On Tue, 3 Nov 2026 14:46:20 -0500 you wrote:
From: Willem de Bruijn <willemb@google.com>
Avoid an easily corruptible callback pointer on skb linear
out-of-bounds write bugs.
skb_shinfo(skb)->destructor_arg points to a struct ubuf_info, whose
first member is a ubuf_info_ops vtable pointer. Corrupting
skb_shared_info gives a trivial one-hop indirect call primitive via
uarg->ops->complete.
[...]
Here is the summary with links:
- [net-next] net: skbuff: replace ubuf_info ops ptr with type id
https://git.kernel.org/netdev/net-next/c/ecca9bb2c855
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html