Re: [PATCH net] 6lowpan: fix netdev_priv() type confusion in lowpan_event()

[Eric Dumazet]

Le ven. 6 nov. 2026 à 23:59, Roman Gushchin <roman.gushchin@xxxxxxxxx> a écrit :
>
> lowpan_event() assumes any netdevice with dev->type == ARPHRD_6LOWPAN
> has a struct lowpan_dev in netdev_priv(dev). However, non-6LoWPAN
> devices can also have ARPHRD_6LOWPAN, e.g. a TUN device via TUNSETLINK
> or a bonding device inheriting dev->type from its lower device.
>
> Bringing such a device up or down causes lowpan_event() to read and
> overwrite unrelated netdev_priv() memory. Since unprivileged users can
> create TUN and bonding devices in a user and network namespace, they
> can corrupt struct bonding and trigger a slab use-after-free.
>
> Also check dev->ndisc_ops == &lowpan_ndisc_ops, which is set only by
> lowpan_register_netdevice() on genuine 6LoWPAN devices.
>
> Signed-off-by: Roman Gushchin <roman.gushchin@xxxxxxxxx>
> Fixes: 5609c185f24d ("6lowpan: iphc: add support for stateful compression")
> Fixes: 2ad3ed59198c ("6lowpan: add 802.15.4 short addr slaac")
> Cc: stable@xxxxxxxxxxxxxxx
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/bug/linux-97b284e0-576e-4373-b62f-eb132f482b91

nit: Signed-off-by should come last, after Fixes:/Reported-by:/Closes:.

The fix itself looks right to me: lowpan_register_netdevice() is the
only place setting dev->ndisc_ops to &lowpan_ndisc_ops, and
bond_setup_by_slave() does not copy ndisc_ops, so this is a reliable
discriminator.

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
Thanks.