netdev - [PATCH] net: ipv6: fix the address length for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241108092555.5714-1-emanuele.santini.88@gmail.com>
Date: Fri,  8 Nov 2024 10:25:55 +0100
From: Emanuele Santini <emanuele.santini.88@...il.com>
To: netdev@...r.kernel.org,
	yoshfuji@...ux-ipv6.org,
	friedrich@...age.de,
	kuba@...nel.org
Cc: davem@...emloft.net,
	pabeni@...hat.com,
	dsahern@...nel.org,
	Emanuele Santini <emanuele.santini.88@...il.com>
Subject: [PATCH] net: ipv6: fix the address length for net_device on a GRE tunnel

The 'addr_len' field in 'net_device' should represent the size of the
hardware address for the device. While GRE tunneling does not require
a hardware address, a random Ethernet address is still assigned to
the 'net_device'. Therefore, the correct 'addr_len' value should be
the size of an Ethernet address (6 bytes), not the size of an IPv6
address.

This fix sets 'addr_len' to the appropriate value, ensuring
consistency in the net_device setup for IPv6 GRE tunnels.

Bug: Setting addr_len to the size of an IPv6 network address (16 bytes)
can cause a packet socket with SOCK_DGRAM to fail on 'sendto' calls.
This happens due to a check in 'packet_snd' for SOCK_DGRAM types,
which validates the address length.

This bug was introduced in kernel version 4.20.0 and is still present in the current version.

Steps to reproduce:

  ip -6 tunnel add <dev_name> mode ip6gre remote <remote_addr> local <local_addr> ttl 255
  ip link set dev <dev_name> up
  busybox udhcpc -i <dev_name> -n -f
  -> It returns Invalid Argument.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=202147
Reported-by: Friedrich Oslage <friedrich@...age.de>
Signed-off-by: Emanuele Santini <emanuele.santini.88@...il.com>
---
 net/ipv6/ip6_gre.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 235808cfec70..db7679b04a02 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1455,7 +1455,7 @@ static void ip6gre_tunnel_setup(struct net_device *dev)
 	dev->type = ARPHRD_IP6GRE;

 	dev->flags |= IFF_NOARP;
-	dev->addr_len = sizeof(struct in6_addr);
+	dev->addr_len = ETH_ALEN;
 	netif_keep_dst(dev);
 	/* This perm addr will be used as interface identifier by IPv6 */
 	dev->addr_assign_type = NET_ADDR_RANDOM;
-- 
2.46.0