On Mon, Feb 1, 2021 at 7:40 PM Jakub Kicinski <[email protected]> wrote: > > On Sat, 30 Jan 2021 18:27:55 -0800 Cong Wang wrote: > > From: Cong Wang <[email protected]> > > > > dev_ifsioc_locked() is called with only RCU read lock, so when > > there is a parallel writer changing the mac address, it could > > get a partially updated mac address, as shown below: > > > > Thread 1 Thread 2 > > // eth_commit_mac_addr_change() > > memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN); > > // dev_ifsioc_locked() > > memcpy(ifr->ifr_hwaddr.sa_data, > > dev->dev_addr,...); > > > > Close this race condition by guarding them with a RW semaphore, > > like netdev_get_name(). The writers take RTNL anyway, so this > > will not affect the slow path. To avoid bothering existing > > dev_set_mac_address() callers in drivers, introduce a new wrapper > > just for user-facing callers in ioctl and rtnetlink. > > Some of the drivers need to be update, tho, right? At a quick look at > least bond and tun seem to be making calls to dev_set_mac_address() > on IOCTL paths.
Ah, good catch! Clearly I missed those special IOCTL's. Thanks,
