Re: [PATCH] net: sparx5/lan969x: do not read past skb->len when injecting a frame

[Simon Horman]

On Wed, Oct 21, 2026 at 01:25:33PM +0200, Daniel Machon wrote:
> > sparx5_inject() writes the frame to the injection FIFO one 32-bit word
> > at a time, and pads frames shorter than 60 bytes with zero words.
> > 
> > Before this patch, the last word is loaded whole even when skb->len is
> > not a multiple of four, so 1 to 3 bytes past the end of the frame are
> > read. For a frame shorter than 60 bytes those bytes are also
> > transmitted, as VLD_BYTES marks the whole last word valid and the
> > padding starts at the next word.
> > 
> > Write the trailing bytes from a zeroed word. The number of words written
> > and VLD_BYTES are unchanged.
> > 
> > Found by an AI code review agent, and reproduced on lan969x and sparx5
> > with register injection: bytes 57 to 59 of a 57 byte frame were not
> > zero. With the fix they are zero, and traffic still passes on both
> > chips.
> > 
> > Fixes: f3cad2611a77 ("net: sparx5: add hostmode with phylink support")
> > Signed-off-by: Daniel Machon <daniel.machon@xxxxxxxxxxxxx>
> 
> I somehow forgot to include the target tree. This one goes to net.

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>