[PATCH nf 2/4] netfilter: nf_log_syslog: fix MAC header dump to use real header length

[Florian Westphal <fw@strlen.de>]

old code unconditionally iterated dev->hard_header_len bytes, assuming
the SKB's MAC header is always exactly that long.

If the actual mac header in the packet is smaller, the loop reads past
the MAC and logs ip/ipv6 header as if it was part of the address.

Use skb_mac_header_len() as the base length, then clamp the result to
dev->hard_header_len so we never read beyond what the
device actually uses for its hard header, even if mac header was
mangled.

LLM finding, no bug was ever reported about this.

Fixes: 7eb9282cd0ef ("netfilter: ipt_LOG/ip6t_LOG: add option to print decoded MAC header")
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 net/netfilter/nf_log_syslog.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c
index 3ff5a49a1c8d..332fe47fd109 100644
--- a/net/netfilter/nf_log_syslog.c
+++ b/net/netfilter/nf_log_syslog.c
@@ -815,14 +815,19 @@ static void dump_mac_header(struct nf_log_buf *m,
 
 fallback:
 	nf_log_buf_add(m, "MAC=");
-	if (dev->hard_header_len && skb_mac_header_was_set(skb) &&
-	    skb_mac_header_len(skb) != 0) {
+	if (dev->hard_header_len && skb_mac_header_was_set(skb)) {
+		unsigned int mac_len = skb_mac_header_len(skb);
 		const unsigned char *p = skb_mac_header(skb);
 		unsigned int i;
 
-		nf_log_buf_add(m, "%02x", *p++);
-		for (i = 1; i < dev->hard_header_len; i++)
-			nf_log_buf_add(m, ":%02x", *p++);
+		if (mac_len > dev->hard_header_len)
+			mac_len = dev->hard_header_len;
+
+		if (mac_len) {
+			nf_log_buf_add(m, "%02x", *p++);
+			for (i = 1; i < mac_len; i++)
+				nf_log_buf_add(m, ":%02x", *p++);
+		}
 	}
 	nf_log_buf_add(m, " ");
 }
-- 
2.56.0