[PATCH net] 6lowpan: fix netdev_priv() type confusion in lowpan_event()

[PATCH net] 6lowpan: fix netdev_priv() type confusion in lowpan_event()

[Roman Gushchin]

lowpan_event() assumes any netdevice with dev->type == ARPHRD_6LOWPAN
has a struct lowpan_dev in netdev_priv(dev). However, non-6LoWPAN
devices can also have ARPHRD_6LOWPAN, e.g. a TUN device via TUNSETLINK
or a bonding device inheriting dev->type from its lower device.

Bringing such a device up or down causes lowpan_event() to read and
overwrite unrelated netdev_priv() memory. Since unprivileged users can
create TUN and bonding devices in a user and network namespace, they
can corrupt struct bonding and trigger a slab use-after-free.

Also check dev->ndisc_ops == &lowpan_ndisc_ops, which is set only by
lowpan_register_netdevice() on genuine 6LoWPAN devices.

Signed-off-by: Roman Gushchin <roman.gushchin@linux.dev>
Fixes: 5609c185f24d ("6lowpan: iphc: add support for stateful compression")
Fixes: 2ad3ed59198c ("6lowpan: add 802.15.4 short addr slaac")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-97b284e0-576e-4373-b62f-eb132f482b91
---
 net/6lowpan/6lowpan_i.h | 13 ++++++++++---
 net/6lowpan/core.c      |  2 +-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/net/6lowpan/6lowpan_i.h b/net/6lowpan/6lowpan_i.h
index 01853cec0209..07f11d4dde6e 100644
--- a/net/6lowpan/6lowpan_i.h
+++ b/net/6lowpan/6lowpan_i.h
@@ -2,19 +2,26 @@
 #ifndef __6LOWPAN_I_H
 #define __6LOWPAN_I_H
 
+#include <linux/if_arp.h>
 #include <linux/netdevice.h>
 
 #include <net/6lowpan.h>
 
-/* caller need to be sure it's dev->type is ARPHRD_6LOWPAN */
+extern const struct ndisc_ops lowpan_ndisc_ops;
+
+static inline bool lowpan_is_dev(const struct net_device *dev)
+{
+	return dev->type == ARPHRD_6LOWPAN &&
+	       dev->ndisc_ops == &lowpan_ndisc_ops;
+}
+
+/* caller must ensure lowpan_is_dev(dev) is true */
 static inline bool lowpan_is_ll(const struct net_device *dev,
 				enum lowpan_lltypes lltype)
 {
 	return lowpan_dev(dev)->lltype == lltype;
 }
 
-extern const struct ndisc_ops lowpan_ndisc_ops;
-
 int addrconf_ifid_802154_6lowpan(u8 *eui, struct net_device *dev);
 
 #ifdef CONFIG_6LOWPAN_DEBUGFS
diff --git a/net/6lowpan/core.c b/net/6lowpan/core.c
index 850d4a185f55..748103d37e31 100644
--- a/net/6lowpan/core.c
+++ b/net/6lowpan/core.c
@@ -113,7 +113,7 @@ static int lowpan_event(struct notifier_block *unused,
 	struct in6_addr addr;
 	int i;
 
-	if (dev->type != ARPHRD_6LOWPAN)
+	if (!lowpan_is_dev(dev))
 		return NOTIFY_DONE;
 
 	idev = __in6_dev_get(dev);
-- 
2.56.0.455.g6c5a503b38-goog

Re: [PATCH net] 6lowpan: fix netdev_priv() type confusion in lowpan_event()

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net] 6lowpan: fix netdev_priv() type confusion in lowpan_event()

[Roman Gushchin]

netdev-bot+sinfo@kernel.org writes:

> Hi!
>
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
>
>  - Whether the issue was actually triggered, or is only theoretical
>    (e.g. found by code inspection). If it was triggered please include
>    the symptoms, like the stack trace or error messages.
>
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
>
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

I've a reproducer which I don't want to post publicly but can share
privately.