[PATCH net] af_packet: Don't send zero-byte data in tpacket_snd().

[PATCH net] af_packet: Don't send zero-byte data in tpacket_snd().

[Eric Dumazet]

syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():

skb_assert_len
WARNING: at include/linux/skbuff.h:2753 skb_assert_len
WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781

Call Trace:
 <TASK>
 dev_queue_xmit include/linux/netdevice.h:3448 [inline]
 packet_xmit+0x243/0x310 net/packet/af_packet.c:276
 tpacket_snd net/packet/af_packet.c:2907 [inline]
 packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134

When sending 0-byte packets via TPACKET ring buffer on devices with no
hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb()
populates an skb with skb->len == 0 and returns 0. tpacket_snd() then
forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to
hit skb_assert_len(skb).

Similar checks exist in packet_snd() via commit dc633700f00f
("net/af_packet: check len when min_header_len equals to 0") and in
packet_sendmsg_spkt() via commit 6a341729fb31 ("af_packet: Don't send
zero-byte data in packet_sendmsg_spkt().").

Return -EINVAL in tpacket_fill_skb() when skb->len is zero to reject
zero-length packets in tpacket_snd().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+30b93b6845b19cc38581@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a79e807.01d0871a.3a0d52.00ac.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/packet/af_packet.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 435756877abaa1ab4c0edcc2346bcb2de3625605..103025c4625fb317e0ecedd12c15857af86b7a65 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2660,6 +2660,9 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
 		len = ((to_write > len_max) ? len_max : to_write);
 	}
 
+	if (unlikely(!skb->len))
+		return -EINVAL;
+
 	packet_parse_headers(skb, sock);
 
 	return tp_len;
-- 
2.55.0.654.g21b8a5bc05-goog

Re: [PATCH net] af_packet: Don't send zero-byte data in tpacket_snd().

[Willem de Bruijn]

Eric Dumazet wrote:
> syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():
> 
> skb_assert_len
> WARNING: at include/linux/skbuff.h:2753 skb_assert_len
> WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781
> 
> Call Trace:
>  <TASK>
>  dev_queue_xmit include/linux/netdevice.h:3448 [inline]
>  packet_xmit+0x243/0x310 net/packet/af_packet.c:276
>  tpacket_snd net/packet/af_packet.c:2907 [inline]
>  packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134
> 
> When sending 0-byte packets via TPACKET ring buffer on devices with no
> hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb()
> populates an skb with skb->len == 0 and returns 0. tpacket_snd() then
> forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to
> hit skb_assert_len(skb).
> 
> Similar checks exist in packet_snd() via commit dc633700f00f
> ("net/af_packet: check len when min_header_len equals to 0") and in
> packet_sendmsg_spkt() via commit 6a341729fb31 ("af_packet: Don't send
> zero-byte data in packet_sendmsg_spkt().").
> 
> Return -EINVAL in tpacket_fill_skb() when skb->len is zero to reject
> zero-length packets in tpacket_snd().
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+30b93b6845b19cc38581@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a79e807.01d0871a.3a0d52.00ac.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>

Re: [PATCH net] af_packet: Don't send zero-byte data in tpacket_snd().

[Jiayuan Chen]

On 8/10/26 11:04 PM, Eric Dumazet wrote:
> syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():
>
> skb_assert_len
> WARNING: at include/linux/skbuff.h:2753 skb_assert_len
> WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781
>
> Call Trace:
>   <TASK>
>   dev_queue_xmit include/linux/netdevice.h:3448 [inline]
>   packet_xmit+0x243/0x310 net/packet/af_packet.c:276
>   tpacket_snd net/packet/af_packet.c:2907 [inline]
>   packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134
>
> When sending 0-byte packets via TPACKET ring buffer on devices with no
> hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb()
> populates an skb with skb->len == 0 and returns 0. tpacket_snd() then
> forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to
> hit skb_assert_len(skb).
>
> Similar checks exist in packet_snd() via commit dc633700f00f
> ("net/af_packet: check len when min_header_len equals to 0") and in
> packet_sendmsg_spkt() via commit 6a341729fb31 ("af_packet: Don't send
> zero-byte data in packet_sendmsg_spkt().").
>
> Return -EINVAL in tpacket_fill_skb() when skb->len is zero to reject
> zero-length packets in tpacket_snd().
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+30b93b6845b19cc38581@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a79e807.01d0871a.3a0d52.00ac.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>


Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>

Fixes: 69e3c75f4d54 ("net: TX_RING and packet mmap") would be more 
accurate but it makes no difference for backports.


> ---
>   net/packet/af_packet.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index 435756877abaa1ab4c0edcc2346bcb2de3625605..103025c4625fb317e0ecedd12c15857af86b7a65 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -2660,6 +2660,9 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
>   		len = ((to_write > len_max) ? len_max : to_write);
>   	}
>   
> +	if (unlikely(!skb->len))
> +		return -EINVAL;
> +
>   	packet_parse_headers(skb, sock);
>   
>   	return tp_len;