Re: [PATCH net 1/1] net: tun: reject addr_len changes with active lists

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

Zhiling Zou wrote:
> TUNSETLINK can change a TAP device's address length while packet
> memberships are active. The address lists are keyed by the current
> address length, so changing it makes subsequent membership cleanup
> lookups fail and strands netdev_hw_addr entries until unregister.
> 
> Reject link-type changes that alter addr_len while either the unicast or
> multicast address list is non-empty. This prevents address entries from
> becoming unreachable through the normal deletion path.
> 
> Fixes: cca8ea3b05c9 ("net: tun: set tun->dev->addr_len during TUNSETLINK processing")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
> ---
>  drivers/net/tun.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/net/tun.c b/drivers/net/tun.c
> index 5a302709a68aa..e5b7729a967de 100644
> --- a/drivers/net/tun.c
> +++ b/drivers/net/tun.c
> @@ -3341,6 +3341,10 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
>  			netif_info(tun, drv, tun->dev,
>  				   "Linktype set failed because interface is up\n");
>  			ret = -EBUSY;
> +		} else if (tun_get_addr_len(arg) != tun->dev->addr_len &&
> +			   (!netdev_uc_empty(tun->dev) ||
> +			    !netdev_mc_empty(tun->dev))) {
> +			ret = -EBUSY;

Insightful comments from the bots

- IPv6 sockets automatically join the all-node multicast groups in
  ipv6_add_dev, so netdev_mc_empty is false for them from the start

- IPv6 membership may already be safe, so could be ignored

- netdev_[mu]c_empty locking requires a different lock held