[PATCH net-next v4 1/2] net: hsr: require valid EOT supervision TLV

luka.gejak
2026-04-01T09:23:51Z

From: Luka Gejak <luka.gejak@linux.dev>

Supervision frames are only valid if terminated with a zero-length EOT
TLV. The current check fails to reject non-EOT entries as the terminal
TLV, potentially allowing malformed supervision traffic.

Fix this by strictly requiring the terminal TLV to be HSR_TLV_EOT
with a length of zero.

Reviewed-by: Felix Maurer <fmaurer@redhat.com>
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
---
net/hsr/hsr_forward.c | 41 ++++++++++++++++++++++-------------------
1 file changed, 22 insertions(+), 19 deletions(-)

diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 0aca859c88cb..17b705235c4a 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -82,39 +82,42 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb)
hsr_sup_tag->tlv.HSR_TLV_length != sizeof(struct hsr_sup_payload))
return false;

- /* Get next tlv */
+ /* Advance past the first TLV payload to reach next TLV header */
total_length += hsr_sup_tag->tlv.HSR_TLV_length;
- if (!pskb_may_pull(skb, total_length))
+ /* Linearize next TLV header before access */
+ if (!pskb_may_pull(skb, total_length + sizeof(struct hsr_sup_tlv)))
return false;
skb_pull(skb, total_length);
hsr_sup_tlv = (struct hsr_sup_tlv *)skb->data;
skb_push(skb, total_length);

- /* if this is a redbox supervision frame we need to verify
- * that more data is available
+ /* Walk through TLVs to find end-of-TLV marker, skipping any unknown
+ * extension TLVs to maintain forward compatibility.
*/
- if (hsr_sup_tlv->HSR_TLV_type == PRP_TLV_REDBOX_MAC) {
- /* tlv length must be a length of a mac address */
- if (hsr_sup_tlv->HSR_TLV_length != sizeof(struct hsr_sup_payload))
- return false;
+ for (;;) {
+ if (hsr_sup_tlv->HSR_TLV_type == HSR_TLV_EOT &&
+ hsr_sup_tlv->HSR_TLV_length == 0)
+ return true;

- /* make sure another tlv follows */
- total_length += sizeof(struct hsr_sup_tlv) + hsr_sup_tlv->HSR_TLV_length;
- if (!pskb_may_pull(skb, total_length))
+ /* Validate known TLV types */
+ if (hsr_sup_tlv->HSR_TLV_type == PRP_TLV_REDBOX_MAC) {
+ if (hsr_sup_tlv->HSR_TLV_length !=
+ sizeof(struct hsr_sup_payload))
+ return false;
+ }
+
+ /* Advance past current TLV: header + payload */
+ total_length += sizeof(struct hsr_sup_tlv) +
+ hsr_sup_tlv->HSR_TLV_length;
+ /* Linearize next TLV header before access */
+ if (!pskb_may_pull(skb,
+ total_length + sizeof(struct hsr_sup_tlv)))
return false;

- /* get next tlv */
skb_pull(skb, total_length);
hsr_sup_tlv = (struct hsr_sup_tlv *)skb->data;
skb_push(skb, total_length);
}
-
- /* end of tlvs must follow at the end */
- if (hsr_sup_tlv->HSR_TLV_type == HSR_TLV_EOT &&
- hsr_sup_tlv->HSR_TLV_length != 0)
- return false;
-
- return true;
}

static bool is_proxy_supervision_frame(struct hsr_priv *hsr,
--
2.53.0