Re: [PATCH net] llc: verify mac len before reading mac header

On Tue, 24 Oct 2023 23:12:13 -0400 Willem de Bruijn wrote:

Fixes: f83f1768f833 ("[LLC]: skb allocation size for responses")

Can respin if necessary.

At least one of the three eth_hdr uses goes back to before the start
of git history.

Right, good enough.

But the one that syzbot exercises is introduced in this commit.

That commit is old enough (2008), that effectively all stable kernels
should receive this. This commit also introduces llc_mac_header_len,
which shows at least one valid L2 header that is not an Ethernet
header, back in the day:

+#ifdef CONFIG_TR
+       case ARPHRD_IEEE802_TR:
+               return sizeof(struct trh_hdr);
+#endif

But that token ring variant was removed in 2012 in commit 211ed865108e
("net: delete all instances of special processing for token ring").