From: Michael Brown <mcb30@ipxe.org>
Date: Sat, 1 Aug 2026 22:46:44 +0000 (+0100)
Subject: [lacp] Fix stripping of trailing padding
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=400920db3bbca649c8f6833d23a8cd04f689ff48;p=thirdparty%2Fipxe.git

[lacp] Fix stripping of trailing padding

The iob_unput() to strip any trailing padding is currently sign
reversed, causing the buffer to be extended rather than truncated.

This can result in uninitialised data within the receive I/O buffer
being passed to the LACP or marker receive handlers and subsequently
echoed back to the sender.

Fix by reversing the subtraction.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
---

diff --git a/src/net/eth_slow.c b/src/net/eth_slow.c
index e3b6a75a7..e4c78acd1 100644
--- a/src/net/eth_slow.c
+++ b/src/net/eth_slow.c
@@ -293,7 +293,7 @@ static int eth_slow_rx ( struct io_buffer *iobuf,
 	}
 
 	/* Strip any trailing padding */
-	iob_unput ( iobuf, ( sizeof ( *eth_slow ) - iob_len ( iobuf ) ) );
+	iob_unput ( iobuf, ( iob_len ( iobuf ) - sizeof ( *eth_slow ) ) );
 
 	/* Handle according to subtype */
 	switch ( eth_slow->header.subtype ) {