net: dsa: tag_brcm: legacy: fix pskb_may_pull length

[ Upstream commit efdddc4484859082da6c7877ed144c8121c8ea55 ]

BRCM_LEG_PORT_ID was incorrectly used for pskb_may_pull length.
The correct check is BRCM_LEG_TAG_LEN + VLAN_HLEN, or 10 bytes.

Fixes: 964dbf186eaa ("net: dsa: tag_brcm: add support for legacy tags")
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20250529124406.2513779-1-noltari@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/dsa/tag_brcm.c b/net/dsa/tag_brcm.c
index ed5f68c4f1dad1062dd9744bb24cd48029763af4..3c681d174c58b42a0141e8d1632bb72b22c203b5 100644 (file)
--- a/net/dsa/tag_brcm.c
+++ b/net/dsa/tag_brcm.c
@@ -253,7 +253,7 @@ static struct sk_buff *brcm_leg_tag_rcv(struct sk_buff *skb,
        int source_port;
        u8 *brcm_tag;
 
-       if (unlikely(!pskb_may_pull(skb, BRCM_LEG_PORT_ID)))
+       if (unlikely(!pskb_may_pull(skb, BRCM_LEG_TAG_LEN + VLAN_HLEN)))
                return NULL;
 
        brcm_tag = dsa_etype_header_pos_rx(skb);