Hi, Thanks for the review. All five findings check out against the source, and I have posted v2 addressing them:
https://lore.kernel.org/netdev/[email protected]/ Point by point: [High] skb_header_pointer() negative offset. Agreed, and I was wrong to doubt __skb_header_pointer() in v1. v2 now uses skb_header_pointer(skb, skb_mac_offset(skb), hlen, &_frame) which covers paged frames as well, instead of my hand-rolled linear-only check. [High] The abs(mac_offset) threshold was inconsistent across hooks. Gone with skb_header_pointer(); the requirement is now expressed as "bytes from the mac header" and follows whatever the hook did to the mac header, including the br_send_bpdu() path where mac_offset is 0. [High] hotdrop silently ignored by ebtables legacy. The match now returns false instead, the ebt_stp_mt() pattern, so legacy ebtables and nftables agree again. The commit message also points users who want such frames dropped at a plain "--802_3 -j DROP" rule rather than hiding a drop inside a SAP/TYPE check. [Medium] Reading 23 bytes for a SAP-only rule. v2 reads only offsetof(struct ebt_802_3_hdr, llc.ui.ctrl) = 16 bytes unless a TYPE constraint is set, so a 21-byte topology change BPDU still matches "--802_3 --802_3-sap 0x42 -j ACCEPT" like it did before (the union type and the control byte are only needed for the TYPE match). [Low] Fixes tag. v2 carries Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") pw-bot: cr Guo Zihao
