Commit f2294260 authored by Luka Gejak's avatar Luka Gejak Committed by Jakub Kicinski
Browse files

net: hsr: fix potential OOB access in supervision frame handling 



Ensure the entire TLV header is linearized before access by adding
sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this,
a truncated frame could cause an out-of-bounds access.

Fixes: eafaa88b ("net: hsr: Add support for redbox supervision frames")
Signed-off-by: default avatarLuka Gejak <luka.gejak@linux.dev>
Reviewed-by: default avatarFernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260523130330.61880-1-luka.gejak@linux.dev


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 2156a29a

net/hsr/hsr_forward.c

+2 −2
Original line number Diff line number Diff line
@@ -84,7 +84,7 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb) 


	/* Get next tlv */

	total_length += hsr_sup_tag->tlv.HSR_TLV_length;

	if (!pskb_may_pull(skb, total_length))

	if (!pskb_may_pull(skb, total_length + sizeof(struct hsr_sup_tlv)))

		return false;

	skb_pull(skb, total_length);

	hsr_sup_tlv = (struct hsr_sup_tlv *)skb->data;
@@ -100,7 +100,7 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb) 


		/* make sure another tlv follows */

		total_length += sizeof(struct hsr_sup_tlv) + hsr_sup_tlv->HSR_TLV_length;

		if (!pskb_may_pull(skb, total_length))

		if (!pskb_may_pull(skb, total_length + sizeof(struct hsr_sup_tlv)))

			return false;



		/* get next tlv */