Re: [PATCH net v2 06/10] net: systemport: Fix potential packet length underflow in bcm_sysport_desc_rx()

[Jakub Kicinski]

On Tue, 22 Sep 2026 16:24:36 -0700 Florian Fainelli wrote:
> In bcm_sysport_desc_rx(), the packet length 'len' extracted from the RSB
> is only validated against RX_BUF_LENGTH. If a malformed or corrupted
> frame is received with 'len' smaller than the prepended Receive Status
> Block (sizeof(*rsb)) plus 2 padding bytes (and optional FCS).
> 
> Furthermore, subtracting (sizeof(*rsb) + 2) from 'len' (u16) will
> underflow, resulting in corrupted packet stats and potential
> out-of-bounds operations.

I don't think we are required to protect from bad/malicious PCI or SoC
devices. If this is a LLM suggestion - up to you if it goes in but
net-next and no Fixes tag.