lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 855/862] net/ieee802154: dont warn zero-sized raw_sendmsg()
    Date
    From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

    [ Upstream commit b12e924a2f5b960373459c8f8a514f887adf5cac ]

    syzbot is hitting skb_assert_len() warning at __dev_queue_xmit() [1],
    for PF_IEEE802154 socket's zero-sized raw_sendmsg() request is hitting
    __dev_queue_xmit() with skb->len == 0.

    Since PF_IEEE802154 socket's zero-sized raw_sendmsg() request was
    able to return 0, don't call __dev_queue_xmit() if packet length is 0.

    ----------
    #include <sys/socket.h>
    #include <netinet/in.h>

    int main(int argc, char *argv[])
    {
    struct sockaddr_in addr = { .sin_family = AF_INET, .sin_addr.s_addr = htonl(INADDR_LOOPBACK) };
    struct iovec iov = { };
    struct msghdr hdr = { .msg_name = &addr, .msg_namelen = sizeof(addr), .msg_iov = &iov, .msg_iovlen = 1 };
    sendmsg(socket(PF_IEEE802154, SOCK_RAW, 0), &hdr, 0);
    return 0;
    }
    ----------

    Note that this might be a sign that commit fd1894224407c484 ("bpf: Don't
    redirect packets with invalid pkt_len") should be reverted, for
    skb->len == 0 was acceptable for at least PF_IEEE802154 socket.

    Link: https://syzkaller.appspot.com/bug?extid=5ea725c25d06fb9114c4 [1]
    Reported-by: syzbot <syzbot+5ea725c25d06fb9114c4@syzkaller.appspotmail.com>
    Fixes: fd1894224407c484 ("bpf: Don't redirect packets with invalid pkt_len")
    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Signed-off-by: Alexander Aring <aahringo@redhat.com>
    Link: https://lore.kernel.org/r/20221005014750.3685555-2-aahringo@redhat.com
    Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/ieee802154/socket.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/net/ieee802154/socket.c
    +++ b/net/ieee802154/socket.c
    @@ -272,6 +272,10 @@ static int raw_sendmsg(struct sock *sk,
    err = -EMSGSIZE;
    goto out_dev;
    }
    + if (!size) {
    + err = 0;
    + goto out_dev;
    + }

    hlen = LL_RESERVED_SPACE(dev);
    tlen = dev->needed_tailroom;

    \
     
     \ /
      Last update: 2022-10-19 15:48    [W:5.372 / U:0.552 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site