From: Jakub Kicinski <kuba@kernel.org>
Date: Thu, 6 Aug 2026 16:01:56 +0000 (-0700)
Subject: Merge branch 'tls-fix-plaintext-sk_msg-ring-over-fill'
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=1f042e426be08a1da57fa7841fd13eb6764f8f60;p=thirdparty%2Fkernel%2Flinux.git

Merge branch 'tls-fix-plaintext-sk_msg-ring-over-fill'

chanyoung says:

====================
tls: fix plaintext sk_msg ring over-fill

An unprivileged user can oops the kernel by splicing into a kTLS socket
whose open record already has a full plaintext sk_msg ring.  Reproduced on
net (53658c6f3682) with a stock config, no KASAN.

Patch 2 oopses an unpatched kernel and passes with patch 1 applied.
====================

Link: https://patch.msgid.link/20260804052837.49015-1-ppoo1220@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

1f042e426be08a1da57fa7841fd13eb6764f8f60