lkml.org 
[lkml]   [2022]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 138/390] net/ieee802154: reject zero-sized raw_sendmsg()
    Date
    From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

    [ Upstream commit 3a4d061c699bd3eedc80dc97a4b2a2e1af83c6f5 ]

    syzbot is hitting skb_assert_len() warning at raw_sendmsg() for ieee802154
    socket. What commit dc633700f00f726e ("net/af_packet: check len when
    min_header_len equals to 0") does also applies to ieee802154 socket.

    Link: https://syzkaller.appspot.com/bug?extid=5ea725c25d06fb9114c4
    Reported-by: syzbot <syzbot+5ea725c25d06fb9114c4@syzkaller.appspotmail.com>
    Fixes: fd1894224407c484 ("bpf: Don't redirect packets with invalid pkt_len")
    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/ieee802154/socket.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
    index 7edec210780a..d4c162d63634 100644
    --- a/net/ieee802154/socket.c
    +++ b/net/ieee802154/socket.c
    @@ -252,6 +252,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
    return -EOPNOTSUPP;
    }

    + if (!size)
    + return -EINVAL;
    +
    lock_sock(sk);
    if (!sk->sk_bound_dev_if)
    dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-24 22:26    [W:4.017 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site