Re: [PATCH net] amt: pull the AMT header behind the transport header in amt_parse_type()

[Paolo Abeni]

On 10/1/26 00:27, Omar Ramadan wrote:
> Found by code inspection: an LLM-assisted review of drivers/net/amt.c
> while I was working on an IPv6 outer transport for amt, whose ICMPv6
> errors would go through amt_err_lookup() the same way.
>
> It has not been triggered. I have no reproducer; it comes from reading
> the code. It needs an ICMP error reaching a gateway's encapsulation
> socket that quotes only the IP and UDP headers of a Request, so that
> amt_parse_type() reads the AMT header past the data it pulled.
>
> Testing: W=1 build with CONFIG_IPV6=y and =n, and
> tools/testing/selftests/net/amt.sh passes with the patch applied, but
> no test injects such an ICMP error, so nothing exercises the changed
> path.

Due to all the above, plus 'broken since the beginning' and Linus
asking only for critical fixes at this point of the cycle, I'm diverting
this one to net-next.

/P