From mboxrd@z Thu Jan  1 00:00:00 1970
From: Vladis Dronov <vdronov@redhat.com>
Subject: Re: [PATCH] net: arp, ipv6: handle special case of tap device
Date: Mon, 1 Oct 2018 07:32:32 -0400 (EDT)
Message-ID: <1615981257.17285278.1538393552487.JavaMail.zimbra@redhat.com>
References: <20180926093018.6646-1-vdronov@redhat.com> <20180929.114023.1370133506922372520.davem@davemloft.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Cc: kuznet@ms2.inr.ac.ru, yoshfuji@linux-ipv6.org,
        netdev@vger.kernel.org, syzkaller@googlegroups.com,
        linux-kernel@vger.kernel.org
To: David Miller <davem@davemloft.net>
Return-path: <linux-kernel-owner@vger.kernel.org>
In-Reply-To: <20180929.114023.1370133506922372520.davem@davemloft.net>
Sender: linux-kernel-owner@vger.kernel.org
List-Id: netdev.vger.kernel.org

Hello, David, all,

> This is insanely ugly.
> I'm not applying this, sorry. 

It is ugly, I agree.

> dev->type determines the link layer header layout and size.

Yes, unfortunately, TUNSETLINK ioctl handler does not adjust all the needed
fields after the tun->dev->type:

[drivers/net/tun.c]
        case TUNSETLINK:
                ...
                tun->dev->type = (int) arg; //<--- that's all

Let me share what I see and let me hope to get an advise for a better fix.
(also another related thread: https://marc.info/?t=153797194500007&r=1&w=2)

- So setting just the tun->dev->type makes the dev struct inconsistent.

- There are more field to adjust, at least dev->addr_len and dev->broadcast.

- There is no get_addr_len_by_link_type() or a simple way to get link layer
  properties by dev->type. Such settings are scattered in *_setup and
  *_init functions, like ipgre_tunnel_init() { ... dev->addr_len = 4; ...}

> I think tun/tap should be prevented from
> allowing the dev->type to be changed, unless it will make those changes
> adjust the link layer headers properly as well.

Probably, this functionality is already used by some userspace, so I believe,
I cannot just remove TUNSETLINK ioctl. Let me try to suggest a patch that
sets dev->addr_len and dev->broadcast (and probably other link-level-related)
fields according to the dev->type.

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer