Re: [PATCH net] net: dsa: tag_brcm: legacy FCS: request needed tailroom

[Florian Fainelli]

On 9/8/26 09:50, Weiming Shi wrote:
> The legacy FCS tagger calculates the CRC over skb->len bytes starting at
> skb->data. When a nonlinear skb reaches the tagger, this reads past the
> linear head into unrelated slab memory.
>
> The tagger appends an Ethernet FCS but does not declare that tailroom. As a
> result, DSA leaves NETIF_F_SG and NETIF_F_FRAGLIST enabled on the user
> port, and nonlinear skbs can reach the CRC calculation.
>
> Declare the required tailroom. DSA will then clear those features and the
> networking core will linearize skbs before the tagger runs.
>
> A KASAN-enabled dsa_loop test using this tagger reports:
>
>    BUG: KASAN: slab-out-of-bounds in crc32_le
>    Read of size 1 at addr ffff8880397086c0 by task exp/135
>
>    Call Trace:
>     crc32_le (lib/crc/crc32-main.c:38)
>     brcm_leg_fcs_tag_xmit (net/dsa/tag_brcm.c:343)
>     dsa_user_xmit (net/dsa/user.c:942)
>     dev_hard_start_xmit (net/core/dev.c:3937)
>     __dev_queue_xmit (net/core/dev.c:4926)
>     packet_sendmsg (net/packet/af_packet.c:3110)
>     __sys_sendto (net/socket.c:2281)
>
>    The buggy address belongs to the object at ffff888039708400
>     which belongs to the cache skbuff_small_head of size 704
>    The buggy address is located 0 bytes to the right of
>     allocated 704-byte region [ffff888039708400, ffff8880397086c0)
>
> Fixes: ef07df397a62 ("net: dsa: tag_brcm: add support for legacy FCS tags")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: co+28eef7d8af9428e6@xxxxxxx
> Closes: https://lore.kernel.org/all/jH6u350kaBRuqklDjd3k3BW4nWzp0tYRjq3p%40bugs.sh/
> Assisted-by: Claude:gpt-5
> Signed-off-by: Weiming Shi <bestswngs@xxxxxxxxx>

Reviewed-by: Florian Fainelli <florian.fainelli@xxxxxxxxxxxx>
--
Florian