From 24614e72df484ad50ecba98aaa88c7df2448c122 Mon Sep 17 00:00:00 2001 From: Avi Weiss Date: Sat, 31 Oct 2026 13:41:35 +0200 Subject: [PATCH] net: skbuff: reject zero MPLS TTL before decrementing skb_mpls_dec_ttl() decrements the u8 TTL before checking whether it expired. An incoming TTL of zero wraps to 255, causing the TC MPLS dec_ttl action to pass an expired packet instead of dropping it. Reject a zero TTL before the decrement while preserving the existing behavior for TTL one and valid TTL values. Fixes: 2a2ea50870ba ("net: sched: add mpls manipulation actions to TC") Signed-off-by: Avi Weiss Reviewed-by: Xia Yan Reviewed-by: Simon Horman Link: https://patch.msgid.link/20261031114135.3784868-2-thnkslprpt@gmail.com Signed-off-by: Paolo Abeni --- net/core/skbuff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 68192e477ff1..8da53d5b76fc 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -6858,7 +6858,7 @@ int skb_mpls_dec_ttl(struct sk_buff *skb) lse = be32_to_cpu(mpls_hdr(skb)->label_stack_entry); ttl = (lse & MPLS_LS_TTL_MASK) >> MPLS_LS_TTL_SHIFT; - if (!--ttl) + if (!ttl || !--ttl) return -EINVAL; lse &= ~MPLS_LS_TTL_MASK;