Re: Re: [PATCH net-next v3 2/3] net: devmem: embed net_iov_area in binding

[Stanislav Fomichev]

> [Severity: Medium]
> Can this loop in net_devmem_bind_dmabuf() write past
> binding->area.niovs[], binding->freelist[] and binding->tx_vec[]?

I do not think this is real. io_uring checks this because I think
area_reg->len is from userspace. For dmabufs, len should be sum(sg->len).

You yourself claim: The in-tree exporters I looked at (udmabuf, dma-heaps,
drm_prime) do build SG tables totalling dmabuf->size...