From: Ido Schimmel <idosch@idosch.org>
To: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Cc: netdev@vger.kernel.org, edumazet@google.com,
Willem de Bruijn <willemb@google.com>,
syzbot <syzkaller@googlegroups.com>
Subject: Re: [PATCH net] packet: validate address length
Date: Sat, 22 Dec 2018 17:39:11 +0200 [thread overview]
Message-ID: <20181222153911.GA7255@splinter> (raw)
In-Reply-To: <20181221170659.93678-1-willemdebruijn.kernel@gmail.com>
On Fri, Dec 21, 2018 at 12:06:59PM -0500, Willem de Bruijn wrote:
> From: Willem de Bruijn <willemb@google.com>
>
> Packet sockets with SOCK_DGRAM may pass an address for use in
> dev_hard_header. Ensure that it is of sufficient length.
>
> Reported-by: syzbot <syzkaller@googlegroups.com>
> Signed-off-by: Willem de Bruijn <willemb@google.com>
Willem,
We use mausezahn [1] in some of the tests under
tools/testing/selftests/net/forwarding/ and I started observing failures
today. Bisected it down to this patch. It seems that mausezahn passes
'sll_halen=0' [2]. Can you please take a look and adjust the check?
Thanks
[1] https://github.com/netsniff-ng/netsniff-ng
[2]
With patch:
# strace -e network mausezahn dummy0 -c 1 -p 64 -a de:ad:be:ef:13:37 -t ip -q
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
socket(AF_PACKET, SOCK_RAW, 768) = 3
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
socket(AF_PACKET, SOCK_RAW, 768) = 3
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
sendto(3, "\377\377\377\377\377\377\336\255\276\357\0237\10\0E\0\0T\0\0\0\0\377\0\273\252\377\377\377\377\377\377"..., 98, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("dummy0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = -1 EINVAL (Invalid argument)
+++ exited with 0 +++
Without patch:
# strace -e network mausezahn dummy0 -c 1 -p 64 -a de:ad:be:ef:13:37 -t ip -q
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
socket(AF_PACKET, SOCK_RAW, 768) = 3
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
socket(AF_PACKET, SOCK_RAW, 768) = 3
setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0
sendto(3, "\377\377\377\377\377\377\336\255\276\357\0237\10\0E\0\0T\0\0\0\0\377\0\273\252\377\377\377\377\377\377"..., 98, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("dummy0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = 98
+++ exited with 0 +++
next prev parent reply other threads:[~2018-12-22 16:57 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-21 17:06 [PATCH net] packet: validate address length Willem de Bruijn
2018-12-21 17:11 ` David Miller
2018-12-22 15:39 ` Ido Schimmel [this message]
2018-12-22 20:05 ` Willem de Bruijn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181222153911.GA7255@splinter \
--to=idosch@idosch.org \
--cc=edumazet@google.com \
--cc=netdev@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
--cc=willemb@google.com \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).