Re: [PATCH net] packet: validate address length

[Ido Schimmel <idosch@idosch.org>]

On Fri, Dec 21, 2018 at 12:06:59PM -0500, Willem de Bruijn wrote:
> From: Willem de Bruijn <willemb@google.com>
> 
> Packet sockets with SOCK_DGRAM may pass an address for use in
> dev_hard_header. Ensure that it is of sufficient length.
> 
> Reported-by: syzbot <syzkaller@googlegroups.com>
> Signed-off-by: Willem de Bruijn <willemb@google.com>

Willem,

We use mausezahn [1] in some of the tests under
tools/testing/selftests/net/forwarding/ and I started observing failures
today. Bisected it down to this patch. It seems that mausezahn passes
'sll_halen=0' [2]. Can you please take a look and adjust the check?

Thanks

[1] https://github.com/netsniff-ng/netsniff-ng

[2]
With patch:
# strace -e network mausezahn dummy0 -c 1 -p 64 -a de:ad:be:ef:13:37 -t ip -q
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
socket(AF_PACKET, SOCK_RAW, 768)        = 3
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
socket(AF_PACKET, SOCK_RAW, 768)        = 3
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
sendto(3, "\377\377\377\377\377\377\336\255\276\357\0237\10\0E\0\0T\0\0\0\0\377\0\273\252\377\377\377\377\377\377"..., 98, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("dummy0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = -1 EINVAL (Invalid argument)
+++ exited with 0 +++

Without patch:
# strace -e network mausezahn dummy0 -c 1 -p 64 -a de:ad:be:ef:13:37 -t ip -q
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
socket(AF_PACKET, SOCK_RAW, 768)        = 3
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
socket(AF_PACKET, SOCK_RAW, 768)        = 3
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
sendto(3, "\377\377\377\377\377\377\336\255\276\357\0237\10\0E\0\0T\0\0\0\0\377\0\273\252\377\377\377\377\377\377"..., 98, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("dummy0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = 98
+++ exited with 0 +++