Subject: Re: [PATCH net-next v6 1/2] net: hsr: require valid EOT supervision TLV

From: Jakub Kicinski <[email-masked]>
Date: Fri, 15 May 2026 17:33:54 -0700

On Wed, 13 May 2026 20:26:56 +0200 [email-masked] wrote:
> @@ -100,7 +100,7 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb)
>  
>  		/* make sure another tlv follows */
>  		total_length += sizeof(struct hsr_sup_tlv) + hsr_sup_tlv->HSR_TLV_length;
> -		if (!pskb_may_pull(skb, total_length))
> +		if (!pskb_may_pull(skb, total_length + sizeof(struct hsr_sup_tlv)))
>  			return false;

pskb_may_pull() changes should go to net?
Someone sending truncated frame may cause an OOB access and crash?

> @@ -110,7 +110,7 @@ static bool is_supervision_frame(struct hsr_priv *hsr, struct sk_buff *skb)
>  	}
>  
>  	/* end of tlvs must follow at the end */
> -	if (hsr_sup_tlv->HSR_TLV_type == HSR_TLV_EOT &&
> +	if (hsr_sup_tlv->HSR_TLV_type != HSR_TLV_EOT ||
>  	    hsr_sup_tlv->HSR_TLV_length != 0)
>  		return false;

And this chunk can go to net-next.

I'll apply patch 2 already, looks uncontroversial