Re: [PATCH] net: arp, ipv6: handle special case of tap device

[Vladis Dronov <vdronov@redhat.com>]

Hello, David, all,

> This is insanely ugly.
> I'm not applying this, sorry. 

It is ugly, I agree.

> dev->type determines the link layer header layout and size.

Yes, unfortunately, TUNSETLINK ioctl handler does not adjust all the needed
fields after the tun->dev->type:

[drivers/net/tun.c]
        case TUNSETLINK:
                ...
                tun->dev->type = (int) arg; //<--- that's all

Let me share what I see and let me hope to get an advise for a better fix.
(also another related thread: https://marc.info/?t=153797194500007&r=1&w=2)

- So setting just the tun->dev->type makes the dev struct inconsistent.

- There are more field to adjust, at least dev->addr_len and dev->broadcast.

- There is no get_addr_len_by_link_type() or a simple way to get link layer
  properties by dev->type. Such settings are scattered in *_setup and
  *_init functions, like ipgre_tunnel_init() { ... dev->addr_len = 4; ...}

> I think tun/tap should be prevented from
> allowing the dev->type to be changed, unless it will make those changes
> adjust the link layer headers properly as well.

Probably, this functionality is already used by some userspace, so I believe,
I cannot just remove TUNSETLINK ioctl. Let me try to suggest a patch that
sets dev->addr_len and dev->broadcast (and probably other link-level-related)
fields according to the dev->type.

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer