[PATCH] tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR

[PATCH] tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR

[Weiming Shi]

In the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an
uninitialised on-stack struct sockaddr_storage to userspace via
ifr_hwaddr, but netif_get_mac_address() only writes sa_family and
dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.

Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a
macvtap chardev returns kernel .text and direct-map pointers, defeating
KASLR.

Initialise ss at declaration.

Fixes: 3b23a32a6321 ("net: fix dev_ifsioc_locked() race condition")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 drivers/net/tap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/tap.c b/drivers/net/tap.c
index b8240737dc51..e1522101b9e4 100644
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@ -923,7 +923,7 @@ static long tap_ioctl(struct file *file, unsigned int cmd,
 	unsigned int __user *up = argp;
 	unsigned short u;
 	int __user *sp = argp;
-	struct sockaddr_storage ss;
+	struct sockaddr_storage ss = {};
 	int s;
 	int ret;
 
-- 
2.43.0

Re: [PATCH] tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR

[Willem de Bruijn]

Weiming Shi wrote:
> In the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an
> uninitialised on-stack struct sockaddr_storage to userspace via
> ifr_hwaddr, but netif_get_mac_address() only writes sa_family and
> dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.
> 
> Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a
> macvtap chardev returns kernel .text and direct-map pointers, defeating
> KASLR.
> 
> Initialise ss at declaration.
> 
> Fixes: 3b23a32a6321 ("net: fix dev_ifsioc_locked() race condition")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Assisted-by: Claude:claude-opus-4-7
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>

Re: [PATCH] tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR

[Willem de Bruijn]

Willem de Bruijn wrote:
> Weiming Shi wrote:
> > In the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an
> > uninitialised on-stack struct sockaddr_storage to userspace via
> > ifr_hwaddr, but netif_get_mac_address() only writes sa_family and
> > dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.
> > 
> > Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a
> > macvtap chardev returns kernel .text and direct-map pointers, defeating
> > KASLR.
> > 
> > Initialise ss at declaration.
> > 
> > Fixes: 3b23a32a6321 ("net: fix dev_ifsioc_locked() race condition")
> > Reported-by: Xiang Mei <xmei5@asu.edu>
> > Assisted-by: Claude:claude-opus-4-7
> > Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> 
> Reviewed-by: Willem de Bruijn <willemb@google.com>

But it should target [PATCH net] and

Cc: Stable@vger.kernel.org

Re: [PATCH] tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 20 May 2026 00:57:38 -0700 you wrote:
> In the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an
> uninitialised on-stack struct sockaddr_storage to userspace via
> ifr_hwaddr, but netif_get_mac_address() only writes sa_family and
> dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.
> 
> Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a
> macvtap chardev returns kernel .text and direct-map pointers, defeating
> KASLR.
> 
> [...]

Here is the summary with links:
  - tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
    https://git.kernel.org/netdev/net/c/bddc09212c24

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html