[PATCH v1 2/2] appletalk: Fix type confusion in handle_ip_over_ddp

[PATCH v1 2/2] appletalk: Fix type confusion in handle_ip_over_ddp

[Lin Ma]

This code uses "ipddp0" calling __dev_get_by_name(), believing it must
return device created in ipddp_init() function, ignoring the fact that a
malicious user could hijack the interface name.

Fortunately, the upstream kernel already removed the code via commit
85605fb694f0 ("appletalk: remove special handling code for ipddp"). This
fix should be applied to other stable versions.

Cc: stable@kernel.org
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
---
 net/appletalk/ddp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 8daa3a1bfa4c..9ecf90102d62 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1296,7 +1296,7 @@ static int handle_ip_over_ddp(struct sk_buff *skb)
 	struct net_device_stats *stats;
 
 	/* This needs to be able to handle ipddp"N" devices */
-	if (!dev) {
+	if (!dev || dev->type != ARPHRD_IPDDP) {
 		kfree_skb(skb);
 		return NET_RX_DROP;
 	}
-- 
2.17.1

Re: [PATCH v1 2/2] appletalk: Fix type confusion in handle_ip_over_ddp

[Simon Horman]

On Thu, Jul 03, 2025 at 01:28:37PM +0800, Lin Ma wrote:
> This code uses "ipddp0" calling __dev_get_by_name(), believing it must
> return device created in ipddp_init() function, ignoring the fact that a
> malicious user could hijack the interface name.
> 
> Fortunately, the upstream kernel already removed the code via commit
> 85605fb694f0 ("appletalk: remove special handling code for ipddp"). This
> fix should be applied to other stable versions.
> 
> Cc: stable@kernel.org
> Signed-off-by: Lin Ma <linma@zju.edu.cn>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

Thanks Lin Ma,

I agree that this code change looks good.
That the code in question has been present since git history started.
And was removed by the commit cited above, in v6.7-rc1.

Reviewed-by: Simon Horman <horms@kernel.org>


Greg,

I'm unsure how this case should be handled from a stable PoV.

...

Re: [PATCH v1 2/2] appletalk: Fix type confusion in handle_ip_over_ddp

[Jakub Kicinski]

On Thu,  3 Jul 2025 13:28:37 +0800 Lin Ma wrote:
> Subject: [PATCH v1 2/2] appletalk: Fix type confusion in handle_ip_over_ddp

I don't see a 1/2 patch anywhere, please repost correctly
-- 
pw-bot: cr