Re: [PATCH nf-next v3 1/2] netfilter: ebtables: ebt_802_3: check the LLC fields before reading them

[Pablo Neira Ayuso]

On Mon, Oct 12, 2026 at 03:24:48PM +0800, Guo Zihao wrote:
> ebt_802_3_mt() takes the frame pointer from skb_mac_header() and reads
> the LLC fields through it without making sure those bytes are there.
> Nothing between the receive path and this match pulls the LLC header,
> so a frame that carries nothing past the 14-byte Ethernet header is
> read past the linear area.

See:

 003f21868b2b ("llc: move the type 2 sockets out of tree")

We can handle this patch in nf-next as low priority.

> The match also reads more of the LLC header than rules look at. A
> SAP-only rule uses dsap/ssap; a rule without any SAP or TYPE constraint
> matches 802.3 frames without touching the LLC header at all, just as it
> did before this patch.
> 
> Require only the bytes each rule actually examines, and go through
> skb_header_pointer() with the mac header offset so short frames fail
> the match instead of being read past the linear area. A frame shorter
> than the fields the rule looks at simply does not match that rule;
> users who want such frames dropped can match 802.3 alone.
> 
> The match itself is not restricted to 802.3 frames: the ebtables
> userspace tool pairs it with "-p Length", but the kernel does not
> enforce that pairing and nft_compat does not run ebt_basic_match(),
> so a SAP or TYPE rule can still see Ethernet II payload bytes,
> bounds checks aside, same as before.
> 
> v2:
>  - rework to skb_header_pointer() with a per-rule length instead of
>    hotdrop, whose semantics differ between ebtables legacy and nftables
>  - read only dsap/ssap for SAP-only rules
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reviewed-by: Liu Chao <liuc63@xxxxxxxxxxxx>
> Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>
> ---
>  net/bridge/netfilter/ebt_802_3.c | 35 +++++++++++++++++++++++---------
>  1 file changed, 25 insertions(+), 10 deletions(-)
> 
> diff --git a/net/bridge/netfilter/ebt_802_3.c b/net/bridge/netfilter/ebt_802_3.c
> index 68c2519bd..fc49f7c7b 100644
> --- a/net/bridge/netfilter/ebt_802_3.c
> +++ b/net/bridge/netfilter/ebt_802_3.c
> @@ -9,32 +9,47 @@
>   *
>   */
>  #include <linux/module.h>
> +#include <linux/stddef.h>
>  #include <linux/netfilter/x_tables.h>
>  #include <linux/netfilter_bridge/ebtables.h>
>  #include <linux/skbuff.h>
>  #include <uapi/linux/netfilter_bridge/ebt_802_3.h>
>  
> -static struct ebt_802_3_hdr *ebt_802_3_hdr(const struct sk_buff *skb)
> -{
> -	return (struct ebt_802_3_hdr *)skb_mac_header(skb);
> -}
> -
>  static bool
>  ebt_802_3_mt(const struct sk_buff *skb, struct xt_action_param *par)
>  {
>  	const struct ebt_802_3_info *info = par->matchinfo;
> -	const struct ebt_802_3_hdr *hdr = ebt_802_3_hdr(skb);
> -	__be16 type = hdr->llc.ui.ctrl & IS_UI ? hdr->llc.ui.type : hdr->llc.ni.type;
> +	struct ebt_802_3_hdr _frame;
> +	const struct ebt_802_3_hdr *frame;
> +	unsigned int hlen;
> +	__be16 type;
> +
> +
> +	if (!(info->bitmask & (EBT_802_3_SAP | EBT_802_3_TYPE)))
> +		return true;
> +
> +
> +	hlen = sizeof(_frame);
> +	if (!(info->bitmask & EBT_802_3_TYPE))
> +		hlen = offsetof(struct ebt_802_3_hdr, llc.ui.ctrl);
> +
> +
> +	frame = skb_header_pointer(skb, skb_mac_offset(skb), hlen, &_frame);
> +	if (!frame)
> +		return false;
>  
>  	if (info->bitmask & EBT_802_3_SAP) {
> -		if (NF_INVF(info, EBT_802_3_SAP, info->sap != hdr->llc.ui.ssap))
> +		if (NF_INVF(info, EBT_802_3_SAP, info->sap != frame->llc.ui.ssap))
>  			return false;
> -		if (NF_INVF(info, EBT_802_3_SAP, info->sap != hdr->llc.ui.dsap))
> +		if (NF_INVF(info, EBT_802_3_SAP, info->sap != frame->llc.ui.dsap))
>  			return false;
>  	}
>  
>  	if (info->bitmask & EBT_802_3_TYPE) {
> -		if (!(hdr->llc.ui.dsap == CHECK_TYPE && hdr->llc.ui.ssap == CHECK_TYPE))
> +		type = frame->llc.ui.ctrl & IS_UI ? frame->llc.ui.type :
> +						    frame->llc.ni.type;
> +		if (!(frame->llc.ui.dsap == CHECK_TYPE &&
> +		      frame->llc.ui.ssap == CHECK_TYPE))
>  			return false;
>  		if (NF_INVF(info, EBT_802_3_TYPE, info->type != type))
>  			return false;
> -- 
> 2.50.1
>