[PATCH 0/1: 5.10/5.15] net: bridge: xmit: make sure we have at least eth header len bytes

[PATCH 0/1: 5.10/5.15] net: bridge: xmit: make sure we have at least eth header len bytes

[Randy.MacLeod]

From: Randy MacLeod <Randy.MacLeod@windriver.com>

This is my first commit to -stable so I'm going to carefully explain what I've done.
I work on the Yocto Project and I have done some work on the Linux network
stack a long time ago so I'm not quite a complete newbie.

I took the commit found here:
   https://lore.kernel.org/stable/20240527185645.658299380@linuxfoundation.org/

and backported as per my commit log:
   Based on above commit but simplified since pskb_may_pull_reason()
   does not exist until 6.1.

I also trimmed the original commit log of the "Tested by dropwatch" section
as well as the full stack trace since that may have changed in 5.10/5.15 and
It compiles fine for 5.10 and 5.15 but I have not tested with dropwatch since
the patch is just dropping short xmit packets for bridging.

Finally, since the patch is much simpler than the original, I've removed the
original patch author's SOB line.

Please let me know if any of this is not what y'all'd like to see.

Randy MacLeod (1):
  net: bridge: xmit: make sure we have at least eth header len bytes

 net/bridge/br_device.c | 5 +++++
 1 file changed, 5 insertions(+)


base-commit: 5a8fa04b2a4de1d52be4a04690dcb52ac7998943
-- 
2.34.1

[PATCH 1/1: 5.10/5.15] net: bridge: xmit: make sure we have at least eth header len bytes

[Randy.MacLeod]

From: Randy MacLeod <Randy.MacLeod@windriver.com>

[ Upstream commit 8bd67ebb50c0145fd2ca8681ab65eb7e8cde1afc ]

Based on above commit but simplified since pskb_may_pull_reason()
does not exist until 6.1.

syzbot triggered an uninit value[1] error in bridge device's xmit path
by sending a short (less than ETH_HLEN bytes) skb. To fix it check if
we can actually pull that amount instead of assuming.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+a63a1f6a062033cf0f40@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a63a1f6a062033cf0f40
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
---
 net/bridge/br_device.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index d3ea9d0779fb..84e37108c6b5 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -36,6 +36,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 	const unsigned char *dest;
 	u16 vid = 0;
 
+	if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) {
+		kfree_skb(skb);
+		return NETDEV_TX_OK;
+	}
+
 	memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
 
 	rcu_read_lock();
-- 
2.34.1