From d1080307282f2b09d788ec1aeb2221800c86bcfe Mon Sep 17 00:00:00 2001 From: Markus Stockhausen Date: Wed, 26 Aug 2026 07:51:40 +0200 Subject: [PATCH] realtek: eth: validate DSA trailer length Check that the skb is large enough to contain the DSA trailer before accessing it in rteth_get_dsa_port(). Without the check, packets shorter than four bytes could result in an out-of-bounds access when looking for the RTL Otto trailer. Return -ENOENT when no valid DSA trailer is present. Assisted-by: ChatGPT (OpenAI GPT-5.6 Sol) Link: https://github.com/openwrt/openwrt/pull/24874 Signed-off-by: Markus Stockhausen --- .../files-6.18/drivers/net/ethernet/realtek/rtl838x_eth.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/target/linux/realtek/files-6.18/drivers/net/ethernet/realtek/rtl838x_eth.c b/target/linux/realtek/files-6.18/drivers/net/ethernet/realtek/rtl838x_eth.c index ad91dd1c071..4a77850e1a4 100644 --- a/target/linux/realtek/files-6.18/drivers/net/ethernet/realtek/rtl838x_eth.c +++ b/target/linux/realtek/files-6.18/drivers/net/ethernet/realtek/rtl838x_eth.c @@ -1214,8 +1214,12 @@ static void rteth_tx_timeout(struct net_device *dev, unsigned int txqueue) static int rteth_get_dsa_port(struct sk_buff *skb, struct net_device *dev) { struct rteth_ctrl *ctrl = netdev_priv(dev); - u8 *trailer = &skb->data[skb->len - 4]; + u8 *trailer; + if (skb->len < 4) + return -ENOENT; + + trailer = &skb->data[skb->len - 4]; if (netdev_uses_dsa(dev) && dev->dsa_ptr->tag_ops->proto == DSA_TAG_PROTO_RTL_OTTO && trailer[0] < ctrl->r->cpu_port && @@ -1224,7 +1228,7 @@ static int rteth_get_dsa_port(struct sk_buff *skb, struct net_device *dev) trailer[3] == 0xef) return trailer[0]; - return -1; + return -ENOENT; } static int rteth_start_xmit(struct sk_buff *skb, struct net_device *dev)