[PATCH net] net: hsr: fix potential OOB access in supervision frame handling

[PATCH net] net: hsr: fix potential OOB access in supervision frame handling

[luka.gejak]

From: Luka Gejak <luka.gejak@linux.dev>

Ensure the entire TLV header is linearized before access by adding
sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this,
a truncated frame could cause an out-of-bounds access.

Assisted-by: Gemini:Gemini-3.1-flash
Fixes: eafaa88b3eb7 ("net: hsr: Add support for redbox supervision frames")
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
---
NOTE: This patch was previously part of a net-next series and was 
seperated as requested by Jakub Kicinski. Link to the old series is [1].
[1]:https://lore.kernel.org/netdev/20260513182657.20346-1-luka.gejak@linux.dev/

 net/hsr/hsr_forward.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 0aca859c88cb..f669a226d728 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -84,7 +84,7 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb)
 
 	/* Get next tlv */
 	total_length += hsr_sup_tag->tlv.HSR_TLV_length;
-	if (!pskb_may_pull(skb, total_length))
+	if (!pskb_may_pull(skb, total_length + sizeof(struct hsr_sup_tlv)))
 		return false;
 	skb_pull(skb, total_length);
 	hsr_sup_tlv = (struct hsr_sup_tlv *)skb->data;
@@ -100,7 +100,7 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb)
 
 		/* make sure another tlv follows */
 		total_length += sizeof(struct hsr_sup_tlv) + hsr_sup_tlv->HSR_TLV_length;
-		if (!pskb_may_pull(skb, total_length))
+		if (!pskb_may_pull(skb, total_length + sizeof(struct hsr_sup_tlv)))
 			return false;
 
 		/* get next tlv */
-- 
2.54.0

Re: [PATCH net] net: hsr: fix potential OOB access in supervision frame handling

[Fernando Fernandez Mancera]

On 5/23/26 3:03 PM, luka.gejak@linux.dev wrote:
> From: Luka Gejak <luka.gejak@linux.dev>
> 
> Ensure the entire TLV header is linearized before access by adding
> sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this,
> a truncated frame could cause an out-of-bounds access.
> 
> Assisted-by: Gemini:Gemini-3.1-flash
> Fixes: eafaa88b3eb7 ("net: hsr: Add support for redbox supervision frames")
> Signed-off-by: Luka Gejak <luka.gejak@linux.dev>

Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>

Thanks!