[PATCH net 1/1] net: tun: reject addr_len changes with active lists

TUNSETLINK can change a TAP device's address length while packet
memberships are active. The address lists are keyed by the current
address length, so changing it makes subsequent membership cleanup
lookups fail and strands netdev_hw_addr entries until unregister.

Reject link-type changes that alter addr_len while either the unicast or
multicast address list is non-empty. This prevents address entries from
becoming unreachable through the normal deletion path.

Fixes: cca8ea3b05c9 ("net: tun: set tun->dev->addr_len during TUNSETLINK processing")
Cc: stable@vger.kernel.org
Reported-by: Vega <redacted>
Signed-off-by: Zhiling Zou <redacted>
---
 drivers/net/tun.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 5a302709a68aa..e5b7729a967de 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c

@@ -3341,6 +3341,10 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
 			netif_info(tun, drv, tun->dev,
 				   "Linktype set failed because interface is up\n");
 			ret = -EBUSY;
+		} else if (tun_get_addr_len(arg) != tun->dev->addr_len &&
+			   (!netdev_uc_empty(tun->dev) ||
+			    !netdev_mc_empty(tun->dev))) {
+			ret = -EBUSY;
 		} else {
 			ret = call_netdevice_notifiers(NETDEV_PRE_TYPE_CHANGE,
 						       tun->dev);

-- 
2.43.0