From mboxrd@z Thu Jan 1 00:00:00 1970 From: Willem de Bruijn Subject: [PATCH net] packet: validate address length Date: Fri, 21 Dec 2018 12:06:59 -0500 Message-ID: <20181221170659.93678-1-willemdebruijn.kernel@gmail.com> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Cc: edumazet@google.com, Willem de Bruijn , syzbot To: netdev@vger.kernel.org Return-path: Received: from mail-qt1-f196.google.com ([209.85.160.196]:41125 "EHLO mail-qt1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732195AbeLURHE (ORCPT ); Fri, 21 Dec 2018 12:07:04 -0500 Received: by mail-qt1-f196.google.com with SMTP id l12so6402732qtf.8 for ; Fri, 21 Dec 2018 09:07:03 -0800 (PST) Sender: netdev-owner@vger.kernel.org List-ID: From: Willem de Bruijn Packet sockets with SOCK_DGRAM may pass an address for use in dev_hard_header. Ensure that it is of sufficient length. Reported-by: syzbot Signed-off-by: Willem de Bruijn --- net/packet/af_packet.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 6655793765b2d..5dda263b4a0a1 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -2627,6 +2627,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) proto = saddr->sll_protocol; addr = saddr->sll_addr; dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex); + if (addr && dev && saddr->sll_halen < dev->addr_len) + goto out; } err = -ENXIO; @@ -2825,6 +2827,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) proto = saddr->sll_protocol; addr = saddr->sll_addr; dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex); + if (addr && dev && saddr->sll_halen < dev->addr_len) + goto out; } err = -ENXIO; -- 2.20.1.415.g653613c723-goog