[PATCH next-next v2] net:mctp: fix setting mctp hdr ver reserved field cause data dropped
From: wit_yuan
Date: Fri Apr 10 2026 - 02:11:51 EST
From: Yuan Zhaoming <yuanzm2@xxxxxxxxxx>
from spec dsp0236_1.2.1.pdf page 26, the mctp header contains the
RSVD(4bit) and Hdr version(4 bit).
mctp_pkttype_receive invoke mctp_hdr, and get mh->ver whole byte
compare the MCTP_VER_MIN, MCTP_VER_MAX. the reserver bits may be by
misleading used.
one type hba card will set pcie vdm header Pad Len the same with RSVD
bit, this will not work on mctp kernel solution.
Signed-off-by: Yuan Zhaoming <yuanzm2@xxxxxxxxxx>
---
include/net/mctp.h | 1 +
net/mctp/route.c | 4 ++--
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/include/net/mctp.h b/include/net/mctp.h
index f481007a6..1392fafe7 100644
--- a/include/net/mctp.h
+++ b/include/net/mctp.h
@@ -35,6 +35,7 @@ struct mctp_hdr {
#define MCTP_HDR_SEQ_MASK GENMASK(1, 0)
#define MCTP_HDR_TAG_SHIFT 0
#define MCTP_HDR_TAG_MASK GENMASK(2, 0)
+#define MCTP_HDR_VER_MASK GENMASK(3, 0)
#define MCTP_INITIAL_DEFAULT_NET 1
diff --git a/net/mctp/route.c b/net/mctp/route.c
index 56c441e90..aa0e89d67 100644
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -464,7 +464,7 @@ static int mctp_dst_input(struct mctp_dst *dst, struct sk_buff *skb)
netid = mctp_cb(skb)->net;
skb_pull(skb, sizeof(struct mctp_hdr));
- if (mh->ver != 1)
+ if (((mh->ver & MCTP_HDR_VER_MASK)) < MCTP_VER_MIN || (mh->ver & MCTP_HDR_VER_MASK) > MCTP_VER_MAX)
goto out;
flags = mh->flags_seq_tag & (MCTP_HDR_FLAG_SOM | MCTP_HDR_FLAG_EOM);
@@ -1345,7 +1345,7 @@ static int mctp_pkttype_receive(struct sk_buff *skb, struct net_device *dev,
/* We have enough for a header; decode and route */
mh = mctp_hdr(skb);
- if (mh->ver < MCTP_VER_MIN || mh->ver > MCTP_VER_MAX)
+ if (((mh->ver & MCTP_HDR_VER_MASK)) < MCTP_VER_MIN || (mh->ver & MCTP_HDR_VER_MASK) > MCTP_VER_MAX)
goto err_drop;
/* source must be valid unicast or null; drop reserved ranges and
--
2.43.0