Re: [PATCH net v2] netfilter: ebtables: ebt_802_3: check the LLC fields before reading them

[Guo Zihao]

Hi Pablo,

thanks for looking at this.

On the target tree: right, there is no reproducer, and I did not run
anything against a real crash, so v3 is tagged [PATCH nf-next v3].

On llc support being removed: I could not find that. The last commit
touching net/bridge/netfilter/ebt_802_3.c in net-next is Jeremy's
header-inlining change from 2019 (85cfbc25e5c5), and the module still
registers "802_3" for NFPROTO_BRIDGE today. Were you thinking of a
pending removal, or of something else? If you do want to drop the
match instead, I am happy to withdraw this series.

The comments are gone in v3, you are right that the call plus git
blame says enough.

Sashiko reported four more items against v2 (1 Low, 3 Medium). All
four check out and v3 deals with them:

 - the commit messages no longer claim that ebt_basic_match()
   pre-filters the protocol; they now say the match is not restricted
   to 802.3 frames and that the kernel never enforced the userspace
   "-p Length" pairing,

 - the TYPE match now reads the header in two steps (dsap/ssap plus
   control first, then the type from the ui or the ni layout), so a
   complete 21/22-byte SNAP UI frame still matches; the 24-byte
   sizeof() requirement is only imposed where the ni type is really
   read,

 - the S/I format test is now (ctrl & IS_UI) == IS_UI, patched 2/2,

 - 2/2 reads the ni-view type at the wire offset with
   get_unaligned_be16(); the padding in struct hdr_ni cannot be
   fixed because the uAPI struct is shared with ebtables userspace.

Series at https://lore.kernel.org/netdev/20261012072721.3306308-1-guozh23@xxxxxxxxxxxx/
([PATCH nf-next v3 1/2]) and thread.

pw-bot: cr

Guo Zihao