Re: [PATCH net] net: hsr: fix mac_len checks

[George McCollister]

On Mon, May 24, 2021 at 4:29 PM Vladimir Oltean <olteanv@xxxxxxxxx> wrote:
[snip]
> > +     ret = hsr->proto_ops->fill_frame_info(proto, skb, frame);
>
> Nitpick: hsr uses "res", not "ret".
>

Oops. I'll try to pay more attention to what is used in the existing
code next time.

[snip]
>
> I admit that I went through both patches and I still don't understand
> what is the code path that the original commit 2e9f60932a2c ("net: hsr:
> check skb can contain struct hsr_ethhdr in fill_frame_info") is
> protecting against. I ran the C reproducer linked by syzbot too and I
> did not reproduce it (I did not compile with the linked clang though).

I think it's complaining if you access more than mac_len bytes from
the pointer returned by skb_mac_header() but I'm not familiar with
this bot.

Thanks for testing the patch.

-George