Re: [PATCH net v4] net: Fix Hole-196 vulnerability by dropping unicast ARP/IP in L2 BMC

[Star Chang <starchang@google.com>]

Hi Julian, Sashiko, and netdev reviewers,

Thank you for the detailed review and feedback.

The points raised regarding the IP part are completely legitimate:
1. The pskb_may_pull() failure path did indeed introduce a potential UAF read of &iph->daddr when skb->head was reallocated.
2. Furthermore, exempting UDP port 68 weakens the Hole-196 protection. In practice, DHCP clients operate via AF_PACKET raw sockets (which tap frames before IP input) or rely on broadcast destination 255.255.255.255 (which routes as RTN_BROADCAST and is never dropped by drop_unicast_in_l2_multicast).
3. The net_warn_ratelimited() calls also introduce potential log suppression risks under a packet flood.

Therefore, we have completely dropped the IP and IPv6 changes (ip_input.c and ip6_input.c), preserving the original silent discard behavior per RFC 1122 and removing the extraneous IPv6 Fixes tag.

On the ARP side:
We have simplified the logic per the discussion with Julian:
- Strictly drop ARP Replies in L2 BMC unless they are Gratuitous ARP (sip == tip), recording SKB_DROP_REASON_UNICAST_IN_L2_MULTICAST via kfree_skb_reason().
- Leave ARP Requests completely untouched per RFC 826 (eliminating any checks on tha).
- Legitimate GARP (sip == tip) defers to the existing drop_gratuitous_arp sysctl.
- Updated Documentation/networking/ip-sysctl.rst accordingly.

We will submit these changes cleanly in v5.

pw-bot: cr