From: Vladis Dronov <vdronov@redhat.com>
To: "David S . Miller" <davem@davemloft.net>,
Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>,
Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
netdev@vger.kernel.org, syzkaller@googlegroups.com,
linux-kernel@vger.kernel.org
Cc: Vladis Dronov <vdronov@redhat.com>
Subject: [PATCH] net: arp, ipv6: handle special case of tap device
Date: Wed, 26 Sep 2018 11:30:18 +0200 [thread overview]
Message-ID: <20180926093018.6646-1-vdronov@redhat.com> (raw)
dev->type can be set to any value for tun/tap devices by TUNSETLINK ioctl.
Nevertheless, all other dev's fields related to the link level like addr_len
and broadcast remain the same as configured previously for ARPHRD_ETHER type,
making dev inconsistent. This can lead to read from uninitialized memory.
Fix this by checking for the case of tun/tap device and act according to the
real link level type of dev while mapping a multicast IP onto multicast MAC
Reported-by: syzbot+d3402c47f680ff24b29c@syzkaller.appspotmail.com
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
---
net/ipv4/arp.c | 9 ++++++++-
net/ipv6/ndisc.c | 9 ++++++++-
2 files changed, 16 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index e90c89ef8c08..9ce472cf98a3 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -187,7 +187,14 @@ EXPORT_SYMBOL(arp_tbl);
int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir)
{
- switch (dev->type) {
+ unsigned short type = dev->type;
+
+#if IS_ENABLED(CONFIG_TAP)
+ if (dev->rtnl_link_ops && !strcmp(dev->rtnl_link_ops->kind, "tun"))
+ type = ARPHRD_ETHER;
+#endif /* CONFIG_TAP */
+
+ switch (type) {
case ARPHRD_ETHER:
case ARPHRD_FDDI:
case ARPHRD_IEEE802:
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 0ec273997d1d..9371ff4454f7 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -283,7 +283,14 @@ struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
{
- switch (dev->type) {
+ unsigned short type = dev->type;
+
+#if IS_ENABLED(CONFIG_TAP)
+ if (dev->rtnl_link_ops && !strcmp(dev->rtnl_link_ops->kind, "tun"))
+ type = ARPHRD_ETHER;
+#endif /* CONFIG_TAP */
+
+ switch (type) {
case ARPHRD_ETHER:
case ARPHRD_IEEE802: /* Not sure. Check it later. --ANK */
case ARPHRD_FDDI:
--
2.19.0
next reply other threads:[~2018-09-26 9:30 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-26 9:30 Vladis Dronov [this message]
2018-09-29 18:40 ` [PATCH] net: arp, ipv6: handle special case of tap device David Miller
2018-10-01 11:32 ` Vladis Dronov
2018-10-03 5:25 ` David Miller
2018-10-03 13:25 ` Vladis Dronov
2018-10-03 16:37 ` David Miller
2018-10-04 9:53 ` Kalle Valo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180926093018.6646-1-vdronov@redhat.com \
--to=vdronov@redhat.com \
--cc=davem@davemloft.net \
--cc=kuznet@ms2.inr.ac.ru \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).