Re: [PATCH net 07/12] net: systemport: Fix potential packet length underflow in bcm_sysport_desc_rx()

Hi Florian

On 22.9.2026 01:13, Florian Fainelli wrote:

In bcm_sysport_desc_rx(), the packet length 'len' extracted from the RSB
is only validated against RX_BUF_LENGTH. If a malformed or corrupted
frame is received with 'len' smaller than the prepended Receive Status
Block (sizeof(*rsb)) plus 2 padding bytes (and optional FCS), calling
skb_pull() will trigger a BUG() in __skb_pull() when pulling beyond
skb->len. Furthermore, subtracting (sizeof(*rsb) + 2) from 'len' (u16)
will underflow, resulting in corrupted packet stats and potential
out-of-bounds operations.

AFAIU skb_pull() returns NULL for len > skb->len and never reaches
__skb_pull(), so it doesn't reach BUG()?

I agree on the underflow and the wrong rx_bytes issue though.

[...]

Thanks
Nicolai