Re: [PATCH net v2] net: atm: implement pre_send to check input before sending

[Paolo Abeni]

On 12/1/25 5:31 AM, Edward Adam Davis wrote:
> diff --git a/net/atm/lec.c b/net/atm/lec.c
> index afb8d3eb2185..8a9660abd134 100644
> --- a/net/atm/lec.c
> +++ b/net/atm/lec.c
> @@ -340,6 +340,23 @@ static int lec_close(struct net_device *dev)
>  	return 0;
>  }
>  
> +static int lec_atm_pre_send(struct atm_vcc *vcc, struct sk_buff *skb)
> +{
> +	struct atmlec_msg *mesg;
> +	int sizeoftlvs;
> +	int msg_size = sizeof(struct atmlec_msg);

Please respect the revers christmas tree above.

> +
> +	if (skb->len < msg_size)
> +		return -EINVAL;
> +
> +	mesg = (struct atmlec_msg *)skb->data;
> +	sizeoftlvs = mesg->sizeoftlvs;
> +	if (sizeoftlvs > 0 && !pskb_may_pull(skb, msg_size + sizeoftlvs))

AI based review noticed that negative `sizeoftlvs` values will foul the
above check:

https://netdev-ai.bots.linux.dev/ai-review.html?id=8b2b0db8-e11a-4215-85a6-a0735c7d908b

AFAICS the lec code always interpret `sizeoftlvs` as u32, regardless of
the type used by `struct atmlec_msg`. I suggest doing the same.

/P