Subject: Re: [PATCH net v4] ipv6: validate extension header length before copying to cmsg

From: Jakub Kicinski <[email-masked]>
Date: Fri, 15 May 2026 17:55:22 -0700

On Thu, 14 May 2026 11:58:02 +0800 Qi Tang wrote:
> +	return (ptr + len <= skb_tail_pointer(skb)) ? len : 0;

This is probably better written as:

	return (len <= skb_tail_pointer(skb) - ptr) ? len : 0;

? len can't be too large so unlikely to matter in practice
but technically ptr + len may overflow and wrap on 32b?
-- 
pw-bot: cr