Subject: Re: [PATCH] tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR

From: Willem de Bruijn <[email-masked]>
Date: Wed, 20 May 2026 17:30:20 -0400

Willem de Bruijn wrote:
> Weiming Shi wrote:
> > In the SIOCGIFHWADDR path, tap_ioctl() copies 16 bytes of an
> > uninitialised on-stack struct sockaddr_storage to userspace via
> > ifr_hwaddr, but netif_get_mac_address() only writes sa_family and
> > dev->addr_len (6 for Ethernet) bytes, leaving sa_data[6..13] uninitialised.
> > 
> > Those 8 trailing bytes leak kernel stack contents; SIOCGIFHWADDR on a
> > macvtap chardev returns kernel .text and direct-map pointers, defeating
> > KASLR.
> > 
> > Initialise ss at declaration.
> > 
> > Fixes: 3b23a32a6321 ("net: fix dev_ifsioc_locked() race condition")
> > Reported-by: Xiang Mei <[email-masked]>
> > Assisted-by: Claude:claude-opus-4-7
> > Signed-off-by: Weiming Shi <[email-masked]>
> 
> Reviewed-by: Willem de Bruijn <[email-masked]>

But it should target [PATCH net] and

Cc: [email-masked]