ACK: [SRU][J][PATCH 0/2] CVE-2026-43456

[Andrei Gherzan]

On 26/09/09 05:21PM, Ian Whitfield via kernel-team wrote:
> [Impact]
> 
> This CVE is fixed with:
> 950803f725472 ("bonding: fix type confusion in bond_setup_by_slave()"):
> 
> When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,
> bond_setup_by_slave() directly copies the slave's header_ops to the
> bond device:
> 
>     bond_dev->header_ops = slave_dev->header_ops;
> 
> This causes a type confusion when dev_hard_header() is later called
> on the bond device. Functions like ipgre_header(), ip6gre_header(),all use
> netdev_priv(dev) to access their device-specific private data. When
> called with the bond device, netdev_priv() returns the bond's private
> data (struct bonding) instead of the expected type (e.g. struct
> ip_tunnel), leading to garbage values being read and kernel crashes.
> 
> Fix this by introducing bond_header_ops with wrapper functions that
> delegate to the active slave's header_ops using the slave's own
> device. This ensures netdev_priv() in the slave's header functions
> always receives the correct device.
> 
> The fix is placed in the bonding driver rather than individual device
> drivers, as the root cause is bond blindly inheriting header_ops from
> the slave without considering that these callbacks expect a specific
> netdev_priv() layout.
> 
> ---
> 
> That patch requires a followup fix:
> b7405dcf73854 ("bonding: prevent potential infinite loop in bond_header_parse()")
> 
> [Backport]
> 
> The CVE fix commit required a context adjustment. The fix for that commit
> applied cleanly from the linux-6.6.y tree.
> 
> [Fix]
> 
> Resolute: Not affected, follow-up fix included
> Noble: Patched by stable upstream, follow-up fix included
> Jammy: Backport with follow-up fix
> Focal: PR on Forgejo
> Bionic: PR on Forgejo
> Xenial: PR on Forgejo
> Trusty: PR on Forgejo
> 
> [Test Case]
> 
> Compile and boot tested.
> 
> [Where problems could occur]
> 
> This fix affects those who use the Ethernet bonding driver to aggregate NICs
> together. An issue with this fix would be visible to the user as kernel BUGs in
> console or unexpected behavior after configuring a bond.
> 
> Eric Dumazet (1):
>   bonding: prevent potential infinite loop in bond_header_parse()
> 
> Jiayuan Chen (1):
>   bonding: fix type confusion in bond_setup_by_slave()
> 
>  drivers/firewire/net.c                        |  5 +-
>  drivers/net/bonding/bond_main.c               | 49 ++++++++++++++++++-
>  drivers/net/wireless/cisco/airo.c             |  4 +-
>  .../wireless/intersil/hostap/hostap_main.c    |  1 +
>  include/linux/etherdevice.h                   |  3 +-
>  include/linux/if_ether.h                      |  3 +-
>  include/linux/netdevice.h                     |  6 ++-
>  net/ethernet/eth.c                            |  9 ++--
>  net/ipv4/ip_gre.c                             |  3 +-
>  net/mac802154/iface.c                         |  4 +-
>  net/phonet/af_phonet.c                        |  5 +-
>  11 files changed, 75 insertions(+), 17 deletions(-)

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260915/a1ae2cc7/attachment.sig>