[PATCH] net: dsa: sja1110: pull meta timestamps before reading them

[Noah Weinberger]

Hello,

sja1110_rcv_meta() walks (n_ts + 1) ten-byte timestamp records starting
at skb->data + 2, but the only linearization on the path is the 4-byte
pskb_may_pull() in sja1110_rcv_inband_control_extension(); nothing
covers the meta payload and nothing compares it against skb->len. A
truncated meta frame (or a non-linear skb) therefore reads up to ~320
bytes past the linear data and feeds garbage into the PTP timestamp
handlers.

The in-band header is generated by the switch itself, so on correctly
functioning silicon the fields are self-consistent; this is hardening
against buggy or compromised switch silicon and against short-skb
conduit paths. The patch pulls the meta payload before the loop.

Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/dsa/tag_sja1105.c:529-573 (sja1110_rcv_meta), 575-598 (caller).
Longstanding code.

This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

Reported-by: Noah Weinberger <noahweinberger2003@xxxxxxxxx>
---
diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
index bfe1f74..caa6659 100644
--- a/net/dsa/tag_sja1105.c
+++ b/net/dsa/tag_sja1105.c
@@ -537,6 +537,12 @@ static struct sk_buff *sja1110_rcv_meta(struct sk_buff *skb, u16 rx_header)
 	struct dsa_switch *ds;
 	int i;
 
+	if (!pskb_may_pull(skb,
+			   2 + (n_ts + 1) * SJA1110_META_TSTAMP_SIZE)) {
+		kfree_skb(skb);
+		return NULL;
+	}
+
 	cpu_dp = conduit->dsa_ptr;
 	ds = dsa_switch_find(cpu_dp->dst->index, switch_id);
 	if (!ds) {