Re: [PATCH net v2 3/6] net: bcmasp: validate minimum RX packet size in bcmasp_rx_poll()

[Justin Chen]

On 10/8/26 2:06 PM, Florian Fainelli wrote:
> In bcmasp_rx_poll(), the driver removes a 2-byte alignment pad and
> optionally strips the ETH_FCS_LEN CRC from received packets before
> passing them to eth_type_trans().
>
> If the hardware reports a descriptor size smaller than the sum of the
> 2-byte pad, the Ethernet header (ETH_HLEN), and optional CRC
> (ETH_FCS_LEN), subtracting the pad and CRC lengths underflows u32 len.
> This adds ~4 GiB to rx_bytes statistics, while the undersized frame
> reaches eth_type_trans(), which reads past skb->len into stale buffer
> data.
>
> Check that desc->size is at least (2 + ETH_HLEN + (crc_fwd ? ETH_FCS_LEN
> : 0)) before proceeding to process the descriptor.
>
> Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller")
> Assisted-by: LLM
> Signed-off-by: Florian Fainelli <florian.fainelli@xxxxxxxxxxxx>
Reviewed-by: Justin Chen <justin.chen@xxxxxxxxxxxx>