diff options
| author | Luka Gejak <luka.gejak@linux.dev> | 2026-05-23 16:04:20 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-05-27 04:41:05 +0300 |
| commit | 46d111a3ef3b5972804dcdce0833767143a12192 (patch) | |
| tree | 4e2e9cff0e5a354a55c6f21f943b0e9bdd6fc130 | |
| parent | 09cfce83e89a456a2587b4317b5395438feb2405 (diff) | |
| download | linux-46d111a3ef3b5972804dcdce0833767143a12192.tar.xz | |
net: hsr: require valid EOT supervision TLV
Supervision frames are only valid if terminated with a zero-length EOT
TLV. The current check fails to reject non-EOT entries as the terminal
TLV, potentially allowing malformed supervision traffic.
Fix this by strictly requiring the terminal TLV to be HSR_TLV_EOT with
a length of zero.
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260523130420.62144-1-luka.gejak@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/hsr/hsr_forward.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c index 0aca859c88cb..5752887c2884 100644 --- a/net/hsr/hsr_forward.c +++ b/net/hsr/hsr_forward.c @@ -110,7 +110,7 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb) } /* end of tlvs must follow at the end */ - if (hsr_sup_tlv->HSR_TLV_type == HSR_TLV_EOT && + if (hsr_sup_tlv->HSR_TLV_type != HSR_TLV_EOT || hsr_sup_tlv->HSR_TLV_length != 0) return false; |