* [PATCH v1 2/2] appletalk: Fix type confusion in handle_ip_over_ddp
@ 2025-07-03 5:28 Lin Ma
2025-07-07 8:52 ` Simon Horman
2025-07-07 21:29 ` Jakub Kicinski
0 siblings, 2 replies; 3+ messages in thread
From: Lin Ma @ 2025-07-03 5:28 UTC (permalink / raw)
To: davem, kuba, linma, netdev, linux-kernel, gregkh; +Cc: stable
This code uses "ipddp0" calling __dev_get_by_name(), believing it must
return device created in ipddp_init() function, ignoring the fact that a
malicious user could hijack the interface name.
Fortunately, the upstream kernel already removed the code via commit
85605fb694f0 ("appletalk: remove special handling code for ipddp"). This
fix should be applied to other stable versions.
Cc: stable@kernel.org
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
---
net/appletalk/ddp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 8daa3a1bfa4c..9ecf90102d62 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1296,7 +1296,7 @@ static int handle_ip_over_ddp(struct sk_buff *skb)
struct net_device_stats *stats;
/* This needs to be able to handle ipddp"N" devices */
- if (!dev) {
+ if (!dev || dev->type != ARPHRD_IPDDP) {
kfree_skb(skb);
return NET_RX_DROP;
}
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH v1 2/2] appletalk: Fix type confusion in handle_ip_over_ddp
2025-07-03 5:28 [PATCH v1 2/2] appletalk: Fix type confusion in handle_ip_over_ddp Lin Ma
@ 2025-07-07 8:52 ` Simon Horman
2025-07-07 21:29 ` Jakub Kicinski
1 sibling, 0 replies; 3+ messages in thread
From: Simon Horman @ 2025-07-07 8:52 UTC (permalink / raw)
To: Lin Ma; +Cc: davem, kuba, netdev, linux-kernel, gregkh, stable
On Thu, Jul 03, 2025 at 01:28:37PM +0800, Lin Ma wrote:
> This code uses "ipddp0" calling __dev_get_by_name(), believing it must
> return device created in ipddp_init() function, ignoring the fact that a
> malicious user could hijack the interface name.
>
> Fortunately, the upstream kernel already removed the code via commit
> 85605fb694f0 ("appletalk: remove special handling code for ipddp"). This
> fix should be applied to other stable versions.
>
> Cc: stable@kernel.org
> Signed-off-by: Lin Ma <linma@zju.edu.cn>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Thanks Lin Ma,
I agree that this code change looks good.
That the code in question has been present since git history started.
And was removed by the commit cited above, in v6.7-rc1.
Reviewed-by: Simon Horman <horms@kernel.org>
Greg,
I'm unsure how this case should be handled from a stable PoV.
...
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v1 2/2] appletalk: Fix type confusion in handle_ip_over_ddp
2025-07-03 5:28 [PATCH v1 2/2] appletalk: Fix type confusion in handle_ip_over_ddp Lin Ma
2025-07-07 8:52 ` Simon Horman
@ 2025-07-07 21:29 ` Jakub Kicinski
1 sibling, 0 replies; 3+ messages in thread
From: Jakub Kicinski @ 2025-07-07 21:29 UTC (permalink / raw)
To: Lin Ma; +Cc: davem, netdev, linux-kernel, gregkh, stable
On Thu, 3 Jul 2025 13:28:37 +0800 Lin Ma wrote:
> Subject: [PATCH v1 2/2] appletalk: Fix type confusion in handle_ip_over_ddp
I don't see a 1/2 patch anywhere, please repost correctly
--
pw-bot: cr
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-07-07 21:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-07-03 5:28 [PATCH v1 2/2] appletalk: Fix type confusion in handle_ip_over_ddp Lin Ma
2025-07-07 8:52 ` Simon Horman
2025-07-07 21:29 ` Jakub Kicinski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).