Re: [PATCH net] 6lowpan: fix netdev_priv() type confusion in lowpan_event()

[Roman Gushchin <roman.gushchin@linux.dev>]

Eric Dumazet <edumazet@kernel.org> writes:

> Le ven. 6 nov. 2026 à 23:59, Roman Gushchin <roman.gushchin@linux.dev> a écrit :
>>
>> lowpan_event() assumes any netdevice with dev->type == ARPHRD_6LOWPAN
>> has a struct lowpan_dev in netdev_priv(dev). However, non-6LoWPAN
>> devices can also have ARPHRD_6LOWPAN, e.g. a TUN device via TUNSETLINK
>> or a bonding device inheriting dev->type from its lower device.
>>
>> Bringing such a device up or down causes lowpan_event() to read and
>> overwrite unrelated netdev_priv() memory. Since unprivileged users can
>> create TUN and bonding devices in a user and network namespace, they
>> can corrupt struct bonding and trigger a slab use-after-free.
>>
>> Also check dev->ndisc_ops == &lowpan_ndisc_ops, which is set only by
>> lowpan_register_netdevice() on genuine 6LoWPAN devices.
>>
>> Signed-off-by: Roman Gushchin <roman.gushchin@linux.dev>
>> Fixes: 5609c185f24d ("6lowpan: iphc: add support for stateful compression")
>> Fixes: 2ad3ed59198c ("6lowpan: add 802.15.4 short addr slaac")
>> Cc: stable@vger.kernel.org
>> Reported-by: Sashiko <sashiko-bot@kernel.org>
>> Closes: https://sashiko.dev/#/bug/linux-97b284e0-576e-4373-b62f-eb132f482b91
>
> nit: Signed-off-by should come last, after Fixes:/Reported-by:/Closes:.
>
> The fix itself looks right to me: lowpan_register_netdevice() is the
> only place setting dev->ndisc_ops to &lowpan_ndisc_ops, and
> bond_setup_by_slave() does not copy ndisc_ops, so this is a reliable
> discriminator.
>
> Reviewed-by: Eric Dumazet <edumazet@kernel.org>
> Thanks.

Thank you for review!

Should I re-spin it with the correct tags order?

Thanks