Skip to contentSkip to conversation

net: core: dev.c confirmed to use classic sockaddr

PATCH In review Kees Cook 2 participants 4 messages Dec 17, 2024 – Dec 18, 2024

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Kees Cook

author
#0 lore raw

PATCH 1/1 net: core: dev.c confirmed to use classic sockaddr

As part of trying to clean up struct sock_addr, add comments about the sockaddr arguments of dev_[gs]et_mac_address() being actual classic "max 14 bytes in sa_data" sockaddr instances and not struct sockaddr_storage.

Signed-off-by Kees Cook <[email protected]>

---
Cc: "David S. Miller" <[email protected]>
Cc: Eric Dumazet <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: Paolo Abeni <[email protected]>
Cc: [email protected]

---
 net/core/dev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
net/core/dev.c +4 -1
index 45a8c3dd4a64..5abfd29a35bf 100644
@@ -9183,7 +9183,8 @@ EXPORT_SYMBOL(dev_pre_changeaddr_notify);
 /**
  *	dev_set_mac_address - Change Media Access Control Address
  *	@dev: device
- *	@sa: new address
+ *	@sa: new address in a classic "struct sockaddr", which will never
+ *	     have more than 14 bytes in @sa::sa_data
  *	@extack: netlink extended ack
  *
  *	Change the hardware (MAC) address of the device

@@ -9217,6 +9218,7 @@ EXPORT_SYMBOL(dev_set_mac_address);
 
 DECLARE_RWSEM(dev_addr_sem);
 
+/* "sa" is a classic sockaddr: it will only ever use 14 bytes from sa_data. */
 int dev_set_mac_address_user(struct net_device *dev, struct sockaddr *sa,
 			     struct netlink_ext_ack *extack)
 {

@@ -9229,6 +9231,7 @@ int dev_set_mac_address_user(struct net_device *dev, struct sockaddr *sa,
 }
 EXPORT_SYMBOL(dev_set_mac_address_user);
 
+/* "sa" is a classic sockaddr: it will only ever use 14 bytes from sa_data. */
 int dev_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name)
 {
 	size_t size = sizeof(sa->sa_data_min);
Signature · 1 line
2.34.1
#1 lore raw
Quoted 3 lines · Kees Cook

As part of trying to clean up struct sock_addr, add comments about the sockaddr arguments of dev_[gs]et_mac_address() being actual classic "max 14 bytes in sa_data" sockaddr instances and not struct sockaddr_storage.

What is this assertion based on?

I see various non-Ethernet .ndo_set_mac_address implementations, which dev_set_mac_address calls. And dev_set_mac_addr_user is called from rtnetlink do_setlink. Which kmalloc's sa based on dev->addr_len.

Quoted 45 lines
Signed-off-by Kees Cook <[email protected]>

---
Cc: "David S. Miller" <[email protected]>
Cc: Eric Dumazet <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: Paolo Abeni <[email protected]>
Cc: [email protected]

---
 net/core/dev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
net/core/dev.c +4 -1
index 45a8c3dd4a64..5abfd29a35bf 100644
@@ -9183,7 +9183,8 @@ EXPORT_SYMBOL(dev_pre_changeaddr_notify);
 /**
  *	dev_set_mac_address - Change Media Access Control Address
  *	@dev: device
- *	@sa: new address
+ *	@sa: new address in a classic "struct sockaddr", which will never
+ *	     have more than 14 bytes in @sa::sa_data
  *	@extack: netlink extended ack
  *
  *	Change the hardware (MAC) address of the device

@@ -9217,6 +9218,7 @@ EXPORT_SYMBOL(dev_set_mac_address);
 
 DECLARE_RWSEM(dev_addr_sem);
 
+/* "sa" is a classic sockaddr: it will only ever use 14 bytes from sa_data. */
 int dev_set_mac_address_user(struct net_device *dev, struct sockaddr *sa,
 			     struct netlink_ext_ack *extack)
 {

@@ -9229,6 +9231,7 @@ int dev_set_mac_address_user(struct net_device *dev, struct sockaddr *sa,
 }
 EXPORT_SYMBOL(dev_set_mac_address_user);
 
+/* "sa" is a classic sockaddr: it will only ever use 14 bytes from sa_data. */
 int dev_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name)
 {
 	size_t size = sizeof(sa->sa_data_min);
Signature · 1 line
2.34.1
author
#2 lore raw
Quoted 10 lines · Willem de Bruijn
Quoted 3 lines · Kees Cook

As part of trying to clean up struct sock_addr, add comments about the sockaddr arguments of dev_[gs]et_mac_address() being actual classic "max 14 bytes in sa_data" sockaddr instances and not struct sockaddr_storage.

What is this assertion based on?

I see various non-Ethernet .ndo_set_mac_address implementations, which dev_set_mac_address calls. And dev_set_mac_addr_user is called from rtnetlink do_setlink. Which kmalloc's sa based on dev->addr_len.

Yeah, I was clearly missing several cases. Please ignore this patch. I will re-examine this.

Signature · 1 line
Kees Cook
author
#3 lore raw
Quoted 6 lines · Kees Cook
Quoted 5 lines · Willem de Bruijn
Quoted 3 lines · Kees Cook

As part of trying to clean up struct sock_addr, add comments about the sockaddr arguments of dev_[gs]et_mac_address() being actual classic "max 14 bytes in sa_data" sockaddr instances and not struct sockaddr_storage.

Quoted 8 lines
Quoted 5 lines

What is this assertion based on?

I see various non-Ethernet .ndo_set_mac_address implementations, which dev_set_mac_address calls. And dev_set_mac_addr_user is called from rtnetlink do_setlink. Which kmalloc's sa based on dev->addr_len.

Yeah, I was clearly missing several cases. Please ignore this patch. I will re-examine this.

So, I think I see what happened -- I missed the dev->addr_len in dev_set_mac_address(), and saw that dev_get_mac_address() caps the address to 14:

        size_t size = sizeof(sa->sa_data_min);
...
        if (!dev->addr_len)
                memset(sa->sa_data, 0, size);
        else
                memcpy(sa->sa_data, dev->dev_addr,
                       min_t(size_t, size, dev->addr_len));

It seems only tun/tap and SIOCGIFHWADDR use the "get" interface, though.

Signature · 1 line
Kees Cook