[BUG] net/dsa: out-of-bounds in crc32_le()

We found a bug reachable in:

    path    net/dsa
    crash   out-of-bounds in crc32_le()
    commit  7cbfb180945c ("net/sched: sch_cake: fix autorate reconfiguration throttling")

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you patch the bug based on our artifacts, a tag would be
    appreciated:

Reported-by: co+28eef7d8af9428e6@bugs.sh

    Everything in this mail is validated by the reproducer below.

    We also hold an LLM-generated root-cause analysis and a candidate
    patch. The patch passes an A/B test: the same reproducer panics the
    unpatched kernel and runs clean on the patched one. Neither has had
    human review, so both still require validation before you send or
    apply them. Available on:

        patch.diff  https://bugs.sh/b/28eef7d8af9428e6/patch.diff
        report.md   https://bugs.sh/b/28eef7d8af9428e6/report.md

    This is an open science project. The code and the full set of PoCs
    are not public at this moment, as we intend to disclose our findings
    in an ethical way.

    Happy to test patches. Complaints and suggestions about our work
    are welcome at:

        cedalion@bugs.sh

== Environment =========================================================
    Reproduced on  7cbfb180945c ("net/sched: sch_cake: fix autorate reconfiguration throttling")
    VM setup       https://bugs.sh/b/28eef7d8af9428e6/run.sh
    config         https://bugs.sh/b/28eef7d8af9428e6/config.gz
    poc            https://bugs.sh/b/28eef7d8af9428e6/repro.c

== Sanitizer Report ====================================================
BUG: KASAN: slab-out-of-bounds in crc32_le (lib/crc/crc32-main.c:38 lib/crc/x86/crc32.h:22 lib/crc/crc32-main.c:74)
Read of size 1 at addr ffff8880131a4fc0 by task exploit/148
CPU: 0 UID: 0 PID: 148 Comm: exploit Tainted: G S 7.2.0+ #63 PREEMPTLAZY
Call Trace:
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
crc32_le (lib/crc/crc32-main.c:38 lib/crc/x86/crc32.h:22 lib/crc/crc32-main.c:74)
brcm_leg_fcs_tag_xmit (net/dsa/tag_brcm.c:343)
dsa_user_xmit (net/dsa/user.c:942)
dev_hard_start_xmit (./include/linux/netdevice.h:5429 ./include/linux/netdevice.h:5438 net/core/dev.c:3937 net/core/dev.c:3953)
__dev_queue_xmit (net/core/dev.c:4926)
packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142)
__sys_sendto (net/socket.c:800 (discriminator 1) net/socket.c:815 (discriminator 1) net/socket.c:2281 (discriminator 1))
__x64_sys_sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284)
do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Allocated by task 148:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
__kasan_slab_alloc (mm/kasan/common.c:340 mm/kasan/common.c:366)
kmem_cache_alloc_node_noprof (include/linux/kasan.h:253 mm/slub.c:4584 mm/slub.c:4917 mm/slub.c:4989)
kmalloc_reserve (net/core/skbuff.c:615 (discriminator 2))
__alloc_skb (net/core/skbuff.c:715)
alloc_skb_with_frags (./include/linux/skbuff.h:1384 net/core/skbuff.c:6786)
sock_alloc_send_pskb (net/core/sock.c:3012)
packet_sendmsg (net/packet/af_packet.c:2959 net/packet/af_packet.c:3053 net/packet/af_packet.c:3142)
__sys_sendto (net/socket.c:800 (discriminator 1) net/socket.c:815 (discriminator 1) net/socket.c:2281 (discriminator 1))
__x64_sys_sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284)
do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The buggy address belongs to the object at ffff8880131a4d00
which belongs to the cache skbuff_small_head of size 704
The buggy address is located 0 bytes to the right of
allocated 704-byte region [ffff8880131a4d00, ffff8880131a4fc0)


---
The report format is based on syzbot bug report.

This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.

For any issue with this report, reach out to cedalion@bugs.sh

If the report is already addressed, let us know by replying with:
#co fix: <commit hash>

If the report is a duplicate of another one, reply with:
#co dup: <lore link>

If you want to undo deduplication, reply with:
#co undup