netdev - Re: [net-next] can: isotp: sanitize CAN ID checks in isotp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3892b065-59e0-3490-50ba-baa56f118859@hartkopp.net>
Date:   Wed, 16 Mar 2022 17:49:35 +0100
From:   Oliver Hartkopp <socketcan@...tkopp.net>
To:     Marc Kleine-Budde <mkl@...gutronix.de>
Cc:     Jakub Kicinski <kuba@...nel.org>, netdev@...r.kernel.org,
        syzbot+2339c27f5c66c652843e@...kaller.appspotmail.com,
        linux-can <linux-can@...r.kernel.org>
Subject: Re: [net-next] can: isotp: sanitize CAN ID checks in isotp_bind()

Hi Marc,

I sent a patch set with three patches on the CAN ML.

Maybe it is just better when you pick them up for a regular process and 
send a pull request to Jakub and Dave.

I still suggest to get these changes in via net-next and send the 
"sanitize CAN ID" backport for the 'older' kernels, when net-next hits 
Linus' tree.

Best regards,
Oliver

On 16.03.22 09:42, Oliver Hartkopp wrote:
> 
> 
> On 16.03.22 09:01, Marc Kleine-Budde wrote:
>> On 16.03.2022 08:53:54, Oliver Hartkopp wrote:
>>>> Should this go into net/master with stable on Cc or to net-next?
>>>
>>> This patch is for net-next as it won't apply to net/master nor the
>>> stable trees due to the recent changes in net-next.
>>>
>>> As it contains a Fixes: tag I would send the patch for the stable
>>> trees when the patch hits Linus' tree and likely Greg would show up
>>> asking for it.
>>>
>>> I hope that's the most elegant process here?!?
>>
>> Another option is to port the patch to net/master with the hope that
>> back porting is easier.
> 
> I have a patch here for net/master that also properly applies down to 
> linux-5.10.y
> If requested I could post it instantly.
> 
>> Then talk to Jakub and David about the merge
>> conflict when net/master is merged to net-next/master.
> 
> Yes. There will be a merge conflict. Therefore I thought bringing that 
> patch for the released 5.17 and the stable trees later would be less 
> effort for Jakub and David.
> 
> Best regards.
> Oliver