net: Fix handling of sockaddrs in the SIOC{ADD,DEL}MULTI handlersHEADmain

The SIOCADDMULTI and SIOCDELMULTI handlers add or delete a link-layer
multicast address from an interface's multicast filter list.  The
link-layer address is passed using the ifr_addr field of the request
structure.

struct ifreq's ifr_addr field is a struct sockaddr, which is a fair bit
smaller than struct sockaddr_dl (though big enough to hold an ethernet
address).  Existing callers set the sockaddr length to
sizeof(struct sockaddr_dl), which is too large, and causes OOB accesses
when if_findmulti() is used to compare the address with others, or when
if_addmulti() makes a copy.

Fix this without breaking compatibility: copy the user-supplied address
into a sockaddr_dl on the stack, and use the latter for the respective
operation.

Also validate the sockaddr_dl internal length fields, suggested by zlei.

Reported by:	Yuxiang Yang, Yizhou Zhao, Ao Wang, Xuewei Feng, Qi Li,
		and Ke Xu from Tsinghua University using GLM-5.2 from Z.ai
Reviewed by:	zlei, ae, glebius
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D59919

0 files changed, 0 insertions, 0 deletions