ACK: [SRU][J/N/P][PATCH 0/1] CVE-2025-38617

[Bethany Jamison]

On 8/26/25 3:55 PM, Tim Whisonant wrote:
> SRU Justification:
>
> [Impact]
>
> net/packet: fix a race in packet_set_ring() and packet_notifier()
>
> When packet_set_ring() releases po->bind_lock, another thread can
> run packet_notifier() and process an NETDEV_UP event.
>
> This race and the fix are both similar to that of commit 15fe076edea7
> ("net/packet: fix a race in packet_bind() and packet_notifier()").
>
> There too the packet_notifier NETDEV_UP event managed to run while a
> po->bind_lock critical section had to be temporarily released. And
> the fix was similarly to temporarily set po->num to zero to keep
> the socket unhooked until the lock is retaken.
>
> The po->bind_lock in packet_set_ring and packet_notifier precede the
> introduction of git history.
>
> [Fix]
>
> Plucky:   applied Noble patch
> Noble:    cherry picked from upstream
> Jammy:    cherry picked from upstream
> Focal:    patch sent to ESM ML
> Bionic:   patch sent to ESM ML
> Xenial:   patch sent to ESM ML
> Trusty:   out of scope (medium CVE)
>
> [Test Plan]
>
> Compile and boot tested.
>
> [Where problems could occur]
>
> The changes affect the raw packet sockets implementation. Issues
> might manifest as mishandled packets.
>
> Quang Le (1):
>    net/packet: fix a race in packet_set_ring() and packet_notifier()
>
>   net/packet/af_packet.c | 12 ++++++------
>   1 file changed, 6 insertions(+), 6 deletions(-)
>
Acked-by: Bethany Jamison <bethany.jamison at canonical.com>