From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 54F4B2AEF5 for ; Mon, 4 May 2026 08:59:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777885173; cv=none; b=CatjV0JhdlHc8d5Ig/GRU0gwvtLq494gWVx7da32Qwtj9mcN4HBP/c8+I4KwbDI65jB/NIXGNK5Ene8FYFZ9FEF0ksJcdpkG97KDe8/tnuwJYu8JZn+vL99w/eb2azzl0WWWgtvcsXHCFU8yh8qFuk31ChM3mQv9WHyuYjq/9nY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777885173; c=relaxed/simple; bh=1wKw7hCRVzNFFy1f4oimRbkr7JRSArL5iWMTZN82Xt0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aqL5ItebpkpYe4UdHbTTB/LA5nc8CsColTRjdk0Xyommz5B//gRwOewasUAVZjEQN123NkD6deG3yNE16AOEioxZ09kOrzwfWYOLaK53NNKJx0WFUdJTLPhHYejwEgARvtDTTlbd5vdRrwsljIukhX2fJzlG2kShBI+xcTpaxqY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FdoN1PfQ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FdoN1PfQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C7658C2BCB9; Mon, 4 May 2026 08:59:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777885173; bh=1wKw7hCRVzNFFy1f4oimRbkr7JRSArL5iWMTZN82Xt0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FdoN1PfQuew4PDoDjLzQfXNpYV7ArS5SSjAAoyE9gIgsDiZ2n2ni6oR+QRpjYBoGP 48beiJh0QZr6y1/ZxVv+bUr+k+82KxOVxi+/DV1nLTY1N1NM3vmTyOrgcvz+WO+OTw cvi66ef4NoSSRLExsTb6j8zEEkUup971tU99Z6Yfe58Z7xoXaLVeXasjHIT86MN/kd 0PyNss8HbVnMA/8TXz/ZDuRc4PE/G1lMMwlYpQi6xL3Ar17KYHDjfcwZtbZAZ2v5p3 McgI8hOsXXGwjBWi5y4ixV0s7JMHZaWXbVU3rzXqFAEAI/b9bBqS0HKHzeInhbP/Hv Q2PxyqYuSJ94Q== From: Sasha Levin To: stable@vger.kernel.org Cc: Yuan Zhaoming , Jeremy Kerr , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.15.y] net: mctp: fix don't require received header reserved bits to be zero Date: Mon, 4 May 2026 04:59:28 -0400 Message-ID: <20260504085928.1894173-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026050124-donation-unloved-dc45@gregkh> References: <2026050124-donation-unloved-dc45@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Yuan Zhaoming [ Upstream commit a663bac71a2f0b3ac6c373168ca57b2a6e6381aa ] >From the MCTP Base specification (DSP0236 v1.2.1), the first byte of the MCTP header contains a 4 bit reserved field, and 4 bit version. On our current receive path, we require those 4 reserved bits to be zero, but the 9500-8i card is non-conformant, and may set these reserved bits. DSP0236 states that the reserved bits must be written as zero, and ignored when read. While the device might not conform to the former, we should accept these message to conform to the latter. Relax our check on the MCTP version byte to allow non-zero bits in the reserved field. Fixes: 889b7da23abf ("mctp: Add initial routing framework") Signed-off-by: Yuan Zhaoming Cc: stable@vger.kernel.org Acked-by: Jeremy Kerr Link: https://patch.msgid.link/20260417141340.5306-1-yuanzhaoming901030@126.com Signed-off-by: Jakub Kicinski [ Context ] Signed-off-by: Sasha Levin --- include/net/mctp.h | 3 +++ net/mctp/route.c | 8 ++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/include/net/mctp.h b/include/net/mctp.h index 8c225091e46cf..b516d7891cae7 100644 --- a/include/net/mctp.h +++ b/include/net/mctp.h @@ -25,6 +25,9 @@ struct mctp_hdr { #define MCTP_VER_MIN 1 #define MCTP_VER_MAX 1 +/* Definitions for ver field */ +#define MCTP_HDR_VER_MASK GENMASK(3, 0) + /* Definitions for flags_seq_tag field */ #define MCTP_HDR_FLAG_SOM BIT(7) #define MCTP_HDR_FLAG_EOM BIT(6) diff --git a/net/mctp/route.c b/net/mctp/route.c index 48d32bfd38636..c6469d7fed199 100644 --- a/net/mctp/route.c +++ b/net/mctp/route.c @@ -229,6 +229,7 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) unsigned long f; u8 tag, flags; int rc; + u8 ver; msk = NULL; rc = -EINVAL; @@ -246,7 +247,8 @@ static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) mh = mctp_hdr(skb); skb_pull(skb, sizeof(struct mctp_hdr)); - if (mh->ver != 1) + ver = mh->ver & MCTP_HDR_VER_MASK; + if (ver < MCTP_VER_MIN || ver > MCTP_VER_MAX) goto out; flags = mh->flags_seq_tag & (MCTP_HDR_FLAG_SOM | MCTP_HDR_FLAG_EOM); @@ -859,6 +861,7 @@ static int mctp_pkttype_receive(struct sk_buff *skb, struct net_device *dev, struct mctp_skb_cb *cb; struct mctp_route *rt; struct mctp_hdr *mh; + u8 ver; /* basic non-data sanity checks */ if (dev->type != ARPHRD_MCTP) @@ -872,7 +875,8 @@ static int mctp_pkttype_receive(struct sk_buff *skb, struct net_device *dev, /* We have enough for a header; decode and route */ mh = mctp_hdr(skb); - if (mh->ver < MCTP_VER_MIN || mh->ver > MCTP_VER_MAX) + ver = mh->ver & MCTP_HDR_VER_MASK; + if (ver < MCTP_VER_MIN || ver > MCTP_VER_MAX) goto err_drop; cb = __mctp_cb(skb); -- 2.53.0