Re: [PATCH net v6 3/6] amt: reject a gateway Query or Data from 0.0.0.0 before a relay is learned

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] amt: wrong Fixes trailer commit in amt_rcv() remote_ip check fix
--

commit 96318be241052a6271835580e7680bbadcc12e44
Author: Omar Ramadan <omar@blockcast.net>

> amt: reject a gateway Query or Data from 0.0.0.0 before a relay is learned
>
> A gateway's amt_rcv() admits a Membership Query or Multicast Data
> message when "saddr != remote_ip" is false. remote_ip is 0 before
> discovery has learned a relay (and is reset to 0 by amt_dev_open(), by
> amt_dev_stop(), and when the gateway gives up after its Requests go
> unanswered), so a packet whose source is 0.0.0.0 would otherwise pass
> the equality check and could spoof a Query or inject multicast data.
> IPv4 input accepts a 0.0.0.0 source only on a limited broadcast, so the
> sender has to be on the gateway's link.
>
> Reject both when no relay is learned: a 0 remote_ip must match nothing, so
> guard the check with !remote_ip. A Query is queued before its event worker
> processes it, so the relay address can also change in that window. Recheck
> the packet source against the current remote_ip in the handler and discard
> stale Queries. Discovery is unaffected because Relay Advertisements are
> validated against discovery_ip, not remote_ip.
>
> Found by code inspection while writing the IPv6 receive path for the
> AMT IPv6 outer transport; not triggered at runtime.
>
> Fixes: b9022b53adad ("amt: add control plane of amt interface")
> Assisted-by: LLM
> Signed-off-by: Omar Ramadan <omar@blockcast.net>

[Severity: Low]
Commit b9022b53adad ("amt: add control plane of amt interface") only added
the control plane setup; amt_rcv() and amt_membership_query_handler() were
introduced in cbc21dc1cfe9 ("amt: add data plane of amt interface"), and
deferred query handling was added in 30e22a6ebca0 ("amt: use workqueue for
gateway side message handling").  Should the Fixes: tag reference those
commits instead?

  Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface")
  Fixes: 30e22a6ebca0 ("amt: use workqueue for gateway side message handling")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107004935.2627329-1-omar@blockcast.net?part=3