From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ido Schimmel Subject: Re: [PATCH net] packet: validate address length Date: Sat, 22 Dec 2018 17:39:11 +0200 Message-ID: <20181222153911.GA7255@splinter> References: <20181221170659.93678-1-willemdebruijn.kernel@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netdev@vger.kernel.org, edumazet@google.com, Willem de Bruijn , syzbot To: Willem de Bruijn Return-path: Received: from out1-smtp.messagingengine.com ([66.111.4.25]:59481 "EHLO out1-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729469AbeLVQ5m (ORCPT ); Sat, 22 Dec 2018 11:57:42 -0500 Content-Disposition: inline In-Reply-To: <20181221170659.93678-1-willemdebruijn.kernel@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: On Fri, Dec 21, 2018 at 12:06:59PM -0500, Willem de Bruijn wrote: > From: Willem de Bruijn > > Packet sockets with SOCK_DGRAM may pass an address for use in > dev_hard_header. Ensure that it is of sufficient length. > > Reported-by: syzbot > Signed-off-by: Willem de Bruijn Willem, We use mausezahn [1] in some of the tests under tools/testing/selftests/net/forwarding/ and I started observing failures today. Bisected it down to this patch. It seems that mausezahn passes 'sll_halen=0' [2]. Can you please take a look and adjust the check? Thanks [1] https://github.com/netsniff-ng/netsniff-ng [2] With patch: # strace -e network mausezahn dummy0 -c 1 -p 64 -a de:ad:be:ef:13:37 -t ip -q socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_PACKET, SOCK_RAW, 768) = 3 setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_PACKET, SOCK_RAW, 768) = 3 setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0 sendto(3, "\377\377\377\377\377\377\336\255\276\357\0237\10\0E\0\0T\0\0\0\0\377\0\273\252\377\377\377\377\377\377"..., 98, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("dummy0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = -1 EINVAL (Invalid argument) +++ exited with 0 +++ Without patch: # strace -e network mausezahn dummy0 -c 1 -p 64 -a de:ad:be:ef:13:37 -t ip -q socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_PACKET, SOCK_RAW, 768) = 3 setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_PACKET, SOCK_RAW, 768) = 3 setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0 sendto(3, "\377\377\377\377\377\377\336\255\276\357\0237\10\0E\0\0T\0\0\0\0\377\0\273\252\377\377\377\377\377\377"..., 98, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("dummy0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = 98 +++ exited with 0 +++