Re: [PATCH net 07/12] net: systemport: Fix potential packet length underflow in bcm_sysport_desc_rx()

[Nicolai Buchwitz]

Hi Florian

On 22.9.2026 01:13, Florian Fainelli wrote:
> In bcm_sysport_desc_rx(), the packet length 'len' extracted from the 
> RSB
> is only validated against RX_BUF_LENGTH. If a malformed or corrupted
> frame is received with 'len' smaller than the prepended Receive Status
> Block (sizeof(*rsb)) plus 2 padding bytes (and optional FCS), calling
> skb_pull() will trigger a BUG() in __skb_pull() when pulling beyond
> skb->len. Furthermore, subtracting (sizeof(*rsb) + 2) from 'len' (u16)
> will underflow, resulting in corrupted packet stats and potential
> out-of-bounds operations.

AFAIU skb_pull() returns NULL for len > skb->len and never reaches
__skb_pull(), so it doesn't reach BUG()?

I agree on the underflow and the wrong rx_bytes issue though.

> [...]

Thanks
Nicolai