netdev - virtio_net: MAC address releated breakage if there is no MAC area in config

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <200904021333.25119.borntraeger@de.ibm.com>
Date:	Thu, 2 Apr 2009 13:33:24 +0200
From:	Christian Borntraeger <borntraeger@...ibm.com>
To:	Alex Williamson <alex.williamson@...com>
Cc:	Rusty Russell <rusty@...tcorp.com.au>, netdev@...r.kernel.org,
	kvm@...r.kernel.org
Subject: virtio_net: MAC address releated breakage if there is no MAC area in config

Hello,

commit 9c46f6d42f1b5627c49a5906cb5b315ad8716ff0
Author: Alex Williamson <alex.williamson@...com>
Date:   Wed Feb 4 16:36:34 2009 -0800
virtio_net: Allow setting the MAC address of the NIC

Introduced an unconditional config->set to the MAC address field of
the device config.

+       } else {
                random_ether_addr(dev->dev_addr);
+               vdev->config->set(vdev, offsetof(struct virtio_net_config, mac),
+                                 dev->dev_addr, dev->addr_len);
+       }

Since our kuli userspace sample does not set VIRTIO_NET_F_MAC, there is no
config space assigned for this device. When virtio_net tries to overwrite
the non-existing field, this triggers a bug.

virtio_net.h specifies:
struct virtio_net_config
{
        /* The config defining mac address (if VIRTIO_NET_F_MAC) */
        __u8 mac[6];
[...]

I read this as the mac config field is optional (similar to all the optional
fields we added in virtio_blk later).

I see two options:
1. Change our sample userspace to always allocate the config (like lguest and
qemu)
2. Change the kernel code to not write into the config unless a specific feature
bit is set. (e.g. VIRTIO_NET_F_SETMAC)

Opinions?

PS: The same is true for virtnet_set_mac_address. it crashes as well
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html