Re: [PATCH net] net: rose: reject truncated CLEAR_REQUEST frames in state machines

patchwork-bot+netdevbpf
2026-04-12T20:20:37Z

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 9 Apr 2026 01:25:51 +0800 you wrote:
> All five ROSE state machines (states 1-5) handle ROSE_CLEAR_REQUEST
> by reading the cause and diagnostic bytes directly from skb->data[3]
> and skb->data[4] without verifying that the frame is long enough:
>
> rose_disconnect(sk, ..., skb->data[3], skb->data[4]);
>
> The entry-point check in rose_route_frame() only enforces
> ROSE_MIN_LEN (3 bytes), so a remote peer on a ROSE network can
> send a syntactically valid but truncated CLEAR_REQUEST (3 or 4
> bytes) while a connection is open in any state. Processing such a
> frame causes a one- or two-byte out-of-bounds read past the skb
> data, leaking uninitialized heap content as the cause/diagnostic
> values returned to user space via getsockopt(ROSE_GETCAUSE).
>
> [...]

Here is the summary with links:
- [net] net: rose: reject truncated CLEAR_REQUEST frames in state machines
https://git.kernel.org/netdev/net/c/2835750dd647

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.