• WANG Cong's avatar
    net: check dev->addr_len for dev_set_mac_address() · 0254e0c6
    WANG Cong authored
    Historically, dev_ifsioc() uses struct sockaddr as mac
    address definition, this is why dev_set_mac_address()
    accepts a struct sockaddr pointer as input but now we
    have various types of mac addresse whose lengths
    are up to MAX_ADDR_LEN, longer than struct sockaddr,
    and saved in dev->addr_len.
    
    It is too late to fix dev_ifsioc() due to API
    compatibility, so just reject those larger than
    sizeof(struct sockaddr), otherwise we would read
    and use some random bytes from kernel stack.
    
    Fortunately, only a few IPv6 tunnel devices have addr_len
    larger than sizeof(struct sockaddr) and they don't support
    ndo_set_mac_addr(). But with team driver, in lb mode, they
    can still be enslaved to a team master and make its mac addr
    length as the same.
    
    Cc: Jiri Pirko <jiri@resnulli.us>
    Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    0254e0c6
dev_ioctl.c 13.1 KB