netdev - Re: [PATCH] net: arp, ipv6: handle special case of tap device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1615981257.17285278.1538393552487.JavaMail.zimbra@redhat.com>
Date:   Mon, 1 Oct 2018 07:32:32 -0400 (EDT)
From:   Vladis Dronov <vdronov@...hat.com>
To:     David Miller <davem@...emloft.net>
Cc:     kuznet@....inr.ac.ru, yoshfuji@...ux-ipv6.org,
        netdev@...r.kernel.org, syzkaller@...glegroups.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: arp, ipv6: handle special case of tap device

Hello, David, all,

> This is insanely ugly.
> I'm not applying this, sorry. 

It is ugly, I agree.

> dev->type determines the link layer header layout and size.

Yes, unfortunately, TUNSETLINK ioctl handler does not adjust all the needed
fields after the tun->dev->type:

[drivers/net/tun.c]
        case TUNSETLINK:
                ...
                tun->dev->type = (int) arg; //<--- that's all

Let me share what I see and let me hope to get an advise for a better fix.
(also another related thread: https://marc.info/?t=153797194500007&r=1&w=2)

- So setting just the tun->dev->type makes the dev struct inconsistent.

- There are more field to adjust, at least dev->addr_len and dev->broadcast.

- There is no get_addr_len_by_link_type() or a simple way to get link layer
  properties by dev->type. Such settings are scattered in *_setup and
  *_init functions, like ipgre_tunnel_init() { ... dev->addr_len = 4; ...}

> I think tun/tap should be prevented from
> allowing the dev->type to be changed, unless it will make those changes
> adjust the link layer headers properly as well.

Probably, this functionality is already used by some userspace, so I believe,
I cannot just remove TUNSETLINK ioctl. Let me try to suggest a patch that
sets dev->addr_len and dev->broadcast (and probably other link-level-related)
fields according to the dev->type.

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer