Re: [PATCH net v2] rds: fix out-of-bounds conn_path walks via handshake exthdrs

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Mon, 12 Oct 2026 10:53:36 +0800 you wrote:
> Both the lane and the connection-generation negotiation are driven by
> extension headers in handshake packets, and both are processed
> unconditionally, even on transports that are not multipath capable.
> A non-MP connection (t_mp_capable unset) owns exactly one
> rds_conn_path slot, so a peer claiming up to RDS_MPATH_WORKERS lanes
> makes every subsequent fan-out walk conn->c_path[0..7] at 504-byte
> strides past the single allocated slot (KASAN: "Read of size 8 in
> rds_conn_path_connect_if_down"); the generation negotiation opens a
> similar out-of-bounds walk on the same array.
> 
> [...]

Here is the summary with links:
  - [net,v2] rds: fix out-of-bounds conn_path walks via handshake exthdrs
    https://git.kernel.org/netdev/net/c/50f2103fce43

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html