Re: [PATCH net] atm: br2684: reject short VC-MUX bridged frames

[Andrew Lunn <andrew@lunn.ch>]

On Sun, Jun 14, 2026 at 11:27:45PM +0800, Yizhou Zhao wrote:
> br2684_push() validates the two-byte pad at the start of received
> VC-MUX bridged frames with memcmp(), but does not first make sure that
> those two bytes are present in the skb.
> 
> A short AAL5 PDU can reach this path after a BR2684 VCC is attached with
> BR2684_ENCAPS_VC and bridged payload.  If skb->len is 0 or 1, the pad
> comparison reads beyond the valid skb data.  When the bytes beyond
> skb->len compare as zero, the code then continues toward eth_type_trans()
> with the malformed frame.
> 
> Reject frames shorter than BR2684_PAD_LEN before checking the pad.  This
> keeps the existing validation for valid VC-MUX bridged frames, which must
> carry the two-byte pad before the Ethernet header.
> 
> Fixes: 7e903c2ae36e ("atm: [br2864] fix routed vcmux support")
> Cc: stable@vger.kernel.org
> Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
> Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
> Reported-by: Ao Wang <wangao@seu.edu.cn>
> Reported-by: Xuewei Feng <fengxw06@126.com>
> Reported-by: Qi Li <qli01@tsinghua.edu.cn>
> Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
> Assisted-by: GLM:GLM-5.1

Same questions as for the previous patch. Lots of parallel
discoveries? What hardware was used, etc.

	     Andrew