Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 996f6e12 authored by WANG Cong's avatar WANG Cong Committed by David S. Miller
Browse files

team: use a larger struct for mac address 



IPv6 tunnels use sizeof(struct in6_addr) as dev->addr_len,
but in many places especially bonding, we use struct sockaddr
to copy and set mac addr, this could lead to stack out-of-bounds
access.

Fix it by using a larger address storage like bonding.

Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Cc: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0254e0c6

drivers/net/team/team.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -60,11 +60,11 @@ static struct team_port *team_port_get_rtnl(const struct net_device *dev) 
static int __set_port_dev_addr(struct net_device *port_dev,

static int __set_port_dev_addr(struct net_device *port_dev,

			       const unsigned char *dev_addr)

			       const unsigned char *dev_addr)

{

{

	struct sockaddr addr;

	struct sockaddr_storage addr;





	memcpy(addr.sa_data, dev_addr, port_dev->addr_len);

	memcpy(addr.__data, dev_addr, port_dev->addr_len);

	addr.sa_family = port_dev->type;

	addr.ss_family = port_dev->type;

	return dev_set_mac_address(port_dev, &addr);

	return dev_set_mac_address(port_dev, (struct sockaddr *)&addr);

}

}





static int team_port_set_orig_dev_addr(struct team_port *port)

static int team_port_set_orig_dev_addr(struct team_port *port)