Re: [PATCH] netfilter: ebtables: ebt_802_3: drop short frames before the match reads LLC

[Guo Zihao <guozh23@xiaopeng.com>]

Hi,

Thanks for the review. All five findings check out against the source,
and I have posted v2 addressing them:

https://lore.kernel.org/netdev/20261008024539.4106699-1-guozh23@xiaopeng.com/

Point by point:

[High] skb_header_pointer() negative offset. Agreed, and I was wrong to
doubt __skb_header_pointer() in v1. v2 now uses

    skb_header_pointer(skb, skb_mac_offset(skb), hlen, &_frame)

which covers paged frames as well, instead of my hand-rolled linear-only
check.

[High] The abs(mac_offset) threshold was inconsistent across hooks.
Gone with skb_header_pointer(); the requirement is now expressed as
"bytes from the mac header" and follows whatever the hook did to the
mac header, including the br_send_bpdu() path where mac_offset is 0.

[High] hotdrop silently ignored by ebtables legacy. The match now
returns false instead, the ebt_stp_mt() pattern, so legacy ebtables and
nftables agree again. The commit message also points users who want such
frames dropped at a plain "--802_3 -j DROP" rule rather than hiding a
drop inside a SAP/TYPE check.

[Medium] Reading 23 bytes for a SAP-only rule. v2 reads only
offsetof(struct ebt_802_3_hdr, llc.ui.ctrl) = 16 bytes unless a TYPE
constraint is set, so a 21-byte topology change BPDU still matches
"--802_3 --802_3-sap 0x42 -j ACCEPT" like it did before (the union type
and the control byte are only needed for the TYPE match).

[Low] Fixes tag. v2 carries

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

pw-bot: cr

Guo Zihao