br2684_push() validates the two-byte pad at the start of received VC-MUX bridged frames with memcmp(), but does not first make sure that those two bytes are present in the skb. A short AAL5 PDU can reach this path after a BR2684 VCC is attached with BR2684_ENCAPS_VC and bridged payload. If skb->len is 0 or 1, the pad comparison reads beyond the valid skb data. When the bytes beyond skb->len compare as zero, the code then continues toward eth_type_trans() with the malformed frame. Reject frames shorter than BR2684_PAD_LEN before checking the pad. This keeps the existing validation for valid VC-MUX bridged frames, which must carry the two-byte pad before the Ethernet header. Fixes: 7e903c2ae36e ("atm: [br2864] fix routed vcmux support") Cc: stable@vger.kernel.org Reported-by: Yizhou Zhao Reported-by: Yuxiang Yang Reported-by: Ao Wang Reported-by: Xuewei Feng Reported-by: Qi Li Reported-by: Ke Xu Assisted-by: GLM:GLM-5.1 Signed-off-by: Yizhou Zhao --- net/atm/br2684.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/atm/br2684.c b/net/atm/br2684.c index 6580d67c3456..07283c475a40 100644 --- a/net/atm/br2684.c +++ b/net/atm/br2684.c @@ -491,6 +491,8 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb) skb->pkt_type = PACKET_HOST; } else { /* p_bridged */ /* first 2 chars should be 0 */ + if (skb->len < BR2684_PAD_LEN) + goto error; if (memcmp(skb->data, pad, BR2684_PAD_LEN) != 0) goto error; skb_pull(skb, BR2684_PAD_LEN); -- 2.43.0