Re: [PATCH v2 net-next] net: dsa: validate source trunk against lags_len

[Vladimir Oltean <olteanv@gmail.com>]

On Thu, Jul 31, 2025 at 07:56:37PM +1000, Luke Howard wrote:
> A DSA frame with an invalid source trunk ID could cause an out-of-bounds
> read access of dst->lags.
> 
> Add a check to dsa_lag_by_id() to validate the LAG ID is not zero, and is
> less than or equal to dst->lags_len. (The LAG ID is derived by adding one
> to the source trunk ID.)
> 
> Note: this is in the fast path for any frames within a trunk.
> 
> Fixes: 5b60dadb71db ("net: dsa: tag_dsa: Support reception of packets from LAG devices")
> Signed-off-by: Luke Howard <lukeh@padl.com>
> ---

1. You need to carry over previous review tags (like from Dawid Osuchowski)
when you send new patch versions.

2. As mentioned in the comments to the previous change, you can submit
patches with a Fixes tag to 'net-next' only if the fixed commit is
exclusively present in net-next. Not the case here.

3. The discussion on v1 is still ongoing, you shouldn't have posted v2
within one minute of replying to the v1 comments. Further changes will
have to be made at least to the commit message of this patch, let's
discuss them back on v1 after we have more data.

pw-bot: changes-requested