net: core: Convert dev_set_mac_address_user() to use struct sockaddr_storage

Convert callers of dev_set_mac_address_user() to use struct
sockaddr_storage. Add sanity checks on dev->addr_len usage.

Signed-off-by: Kees Cook <kees@kernel.org>
Acked-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://patch.msgid.link/20250521204619.2301870-8-kees@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index d4ece538f1b23789ca60caa6232690e4d0a4d14a..bdf0788d8e666d64a97bb608348e8aa6770e6fa0 100644 (file)
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -923,7 +923,7 @@ static long tap_ioctl(struct file *file, unsigned int cmd,
        unsigned int __user *up = argp;
        unsigned short u;
        int __user *sp = argp;
-       struct sockaddr sa;
+       struct sockaddr_storage ss;
        int s;
        int ret;
 
@@ -1000,16 +1000,17 @@ static long tap_ioctl(struct file *file, unsigned int cmd,
                        return -ENOLINK;
                }
                ret = 0;
-               dev_get_mac_address(&sa, dev_net(tap->dev), tap->dev->name);
+               dev_get_mac_address((struct sockaddr *)&ss, dev_net(tap->dev),
+                                   tap->dev->name);
                if (copy_to_user(&ifr->ifr_name, tap->dev->name, IFNAMSIZ) ||
-                   copy_to_user(&ifr->ifr_hwaddr, &sa, sizeof(sa)))
+                   copy_to_user(&ifr->ifr_hwaddr, &ss, sizeof(ifr->ifr_hwaddr)))
                        ret = -EFAULT;
                tap_put_tap_dev(tap);
                rtnl_unlock();
                return ret;
 
        case SIOCSIFHWADDR:
-               if (copy_from_user(&sa, &ifr->ifr_hwaddr, sizeof(sa)))
+               if (copy_from_user(&ss, &ifr->ifr_hwaddr, sizeof(ifr->ifr_hwaddr)))
                        return -EFAULT;
                rtnl_lock();
                tap = tap_get_tap_dev(q);
@@ -1017,7 +1018,10 @@ static long tap_ioctl(struct file *file, unsigned int cmd,
                        rtnl_unlock();
                        return -ENOLINK;
                }
-               ret = dev_set_mac_address_user(tap->dev, &sa, NULL);
+               if (tap->dev->addr_len > sizeof(ifr->ifr_hwaddr))
+                       ret = -EINVAL;
+               else
+                       ret = dev_set_mac_address_user(tap->dev, &ss, NULL);
                tap_put_tap_dev(tap);
                rtnl_unlock();
                return ret;

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7babd1e9a378b33f23d91e08b7e880e87531dbc4..1207196cbbedbf41c7bdd16a17a9dfffc87c8ebe 100644 (file)
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -3193,7 +3193,13 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
 
        case SIOCSIFHWADDR:
                /* Set hw address */
-               ret = dev_set_mac_address_user(tun->dev, &ifr.ifr_hwaddr, NULL);
+               if (tun->dev->addr_len > sizeof(ifr.ifr_hwaddr)) {
+                       ret = -EINVAL;
+                       break;
+               }
+               ret = dev_set_mac_address_user(tun->dev,
+                                              (struct sockaddr_storage *)&ifr.ifr_hwaddr,
+                                              NULL);
                break;
 
        case TUNGETSNDBUF:

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index b4242b997373c778336491b264fa936e24a3cfce..adb14db257984e4b704a514e4be674e82b72c1d4 100644 (file)
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -4216,7 +4216,7 @@ int netif_set_mac_address(struct net_device *dev, struct sockaddr_storage *ss,
                          struct netlink_ext_ack *extack);
 int dev_set_mac_address(struct net_device *dev, struct sockaddr_storage *ss,
                        struct netlink_ext_ack *extack);
-int dev_set_mac_address_user(struct net_device *dev, struct sockaddr *sa,
+int dev_set_mac_address_user(struct net_device *dev, struct sockaddr_storage *ss,
                             struct netlink_ext_ack *extack);
 int dev_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name);
 int dev_get_port_parent_id(struct net_device *dev,

diff --git a/net/core/dev_api.c b/net/core/dev_api.c
index 6011a5ef649d0129c64994cebb4037ef570e7c7e..1bf0153195f26b41584b312812b650da80369113 100644 (file)
--- a/net/core/dev_api.c
+++ b/net/core/dev_api.c
@@ -84,14 +84,15 @@ void dev_set_group(struct net_device *dev, int new_group)
        netdev_unlock_ops(dev);
 }
 
-int dev_set_mac_address_user(struct net_device *dev, struct sockaddr *sa,
+int dev_set_mac_address_user(struct net_device *dev,
+                            struct sockaddr_storage *ss,
                             struct netlink_ext_ack *extack)
 {
        int ret;
 
        down_write(&dev_addr_sem);
        netdev_lock_ops(dev);
-       ret = netif_set_mac_address(dev, (struct sockaddr_storage *)sa, extack);
+       ret = netif_set_mac_address(dev, ss, extack);
        netdev_unlock_ops(dev);
        up_write(&dev_addr_sem);
 

diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index fff13a8b48f182546f04ba9c22363f69af64451e..616479e714663376dc92098fdd2704c25bdd938b 100644 (file)
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -572,9 +572,11 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, void __user *data,
                return dev_set_mtu(dev, ifr->ifr_mtu);
 
        case SIOCSIFHWADDR:
-               if (dev->addr_len > sizeof(struct sockaddr))
+               if (dev->addr_len > sizeof(ifr->ifr_hwaddr))
                        return -EINVAL;
-               return dev_set_mac_address_user(dev, &ifr->ifr_hwaddr, NULL);
+               return dev_set_mac_address_user(dev,
+                                               (struct sockaddr_storage *)&ifr->ifr_hwaddr,
+                                               NULL);
 
        case SIOCSIFHWBROADCAST:
                if (ifr->ifr_hwaddr.sa_family != dev->type)