Skip to contentSkip to conversation

net: hsr: fix potential OOB access in supervision frame handling

PATCH Applied [email protected] 3 participants 3 messages May 23 – May 25

Subsystems (3)
Networking Network drivers HSR network protocol
lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/1 net: hsr: fix potential OOB access in supervision frame handling

From: Luka Gejak <[email protected]>

Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this, a truncated frame could cause an out-of-bounds access.

Assisted-by Gemini:Gemini-3.1-flash
Fixes eafaa88b3eb7 ("net: hsr: Add support for redbox supervision frames")
Signed-off-by Luka Gejak <[email protected]>

---
NOTE: This patch was previously part of a net-next series and was seperated as requested by Jakub Kicinski. Link to the old series is [1]. [1]:https://lore.kernel.org/netdev/[email protected]/

 net/hsr/hsr_forward.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
net/hsr/hsr_forward.c +2 -2
index 0aca859c88cb..f669a226d728 100644
@@ -84,7 +84,7 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb)
 
 	/* Get next tlv */
 	total_length += hsr_sup_tag->tlv.HSR_TLV_length;
-	if (!pskb_may_pull(skb, total_length))
+	if (!pskb_may_pull(skb, total_length + sizeof(struct hsr_sup_tlv)))
 		return false;
 	skb_pull(skb, total_length);
 	hsr_sup_tlv = (struct hsr_sup_tlv *)skb->data;

@@ -100,7 +100,7 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb)
 
 		/* make sure another tlv follows */
 		total_length += sizeof(struct hsr_sup_tlv) + hsr_sup_tlv->HSR_TLV_length;
-		if (!pskb_may_pull(skb, total_length))
+		if (!pskb_may_pull(skb, total_length + sizeof(struct hsr_sup_tlv)))
 			return false;
 
 		/* get next tlv */
Signature · 1 line
2.54.0
Reviewed-by on v1 1/1
#1 lore raw
Quoted 9 lines · On 5/23/26 3:03 PM, [email protected] wrote:

From: Luka Gejak <[email protected]>

Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this, a truncated frame could cause an out-of-bounds access.

Assisted-by Gemini:Gemini-3.1-flash
Fixes eafaa88b3eb7 ("net: hsr: Add support for redbox supervision frames")
Signed-off-by Luka Gejak <[email protected]>
Reviewed-by Fernando Fernandez Mancera <[email protected]>

Thanks!

CI Applied
#2 lore raw
In reply to [email protected]
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 11 lines · On Sat, 23 May 2026 15:03:30 +0200 you wrote:

From: Luka Gejak <[email protected]>

Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this, a truncated frame could cause an out-of-bounds access.

Assisted-by Gemini:Gemini-3.1-flash
Fixes eafaa88b3eb7 ("net: hsr: Add support for redbox supervision frames")
Signed-off-by Luka Gejak <[email protected]>

[...]

Here is the summary with links:
- [net] net: hsr: fix potential OOB access in supervision frame handling

    https://git.kernel.org/netdev/net/c/f229426072fc

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html