From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7B6F63822BF for ; Sun, 30 Aug 2026 18:09:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.199 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788113360; cv=none; b=fqdjUoZ/LWhaV1aJWrghDLHBaUQ70OFJX+xm8aW1Ue/BUCoVEsAKWctg3wqX2+BqhYiK+RjVwCHWl3zrIDsMpzZ5Lhh5AyRtbG4bzjaWDvG0Pha8rktedR2aaDFhsm+MHw8HNYYrMyPF+DefY8kUWXBYfN/8f0C17+FdafNHNtE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788113360; c=relaxed/simple; bh=Oi9pGhyf1oibkGdQSafuUV7+AgzuIxO+oIFaOy++0Q4=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=Llf7NlKGBRiX2G1WJsiaNUzOYvUiXWi6y5M5/M5Up9y7nNxb/OmCLDQtOgi7Lz6L/sfHZkIg+yIonti7MvKCd8i0vqLMWyclPQthgHCQPUd5xbAOQme0yH4whSrfAFvrZ54A9PFG9QlPmlxnYvSqr6eMvW57K/WJGKPYLy9b46o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--kuniyu.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=Eu3YLnaT; arc=none smtp.client-ip=209.85.214.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--kuniyu.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Eu3YLnaT" Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2cec4226c70so32158225ad.1 for ; Sun, 30 Aug 2026 11:09:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788113358; x=1788718158; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:mime-version:date:from :to:cc:subject:date:message-id:reply-to:content-type; bh=dBFhZ8lYiuQBbDEiiV87ebiEVRSTjR96743wnJro3F0=; b=Eu3YLnaT0Jv1gl6+pVekSItVRsGamhCm/3V0rDokuxjD/pM1U+Jxtfroou6QQXgnSw pUV7o/3K0c/QHDvqGDIq1/oG3xtWA+caLX84nPbJC+r9EWK6oz+bqdVow94+NXaF3LYj u4OwdWWpJ7u758nEp2YDW4FQiHB/yBjGZPxKou02yIVpQOQyf3YMcN/8mG1FcQwW1zrF 4WvRzBaKgUHeF0bpxHoq9vntePdIHsqKD4pPh31o2b+dlvWDbJOExRikvUpWkLcSCnSn Wpm7rHbhegG5uucqCZsoMY1mzgAIqxE/0yMkbHxeR/FR/uRK2rou/sgZYYN8rxoZdoTq W8qQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788113358; x=1788718158; h=content-type:cc:to:from:subject:message-id:mime-version:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=dBFhZ8lYiuQBbDEiiV87ebiEVRSTjR96743wnJro3F0=; b=J/EJPRMtCGbuMfIzqpnrKkkh4hYeEMO74twUqeOF95QZ+UGia6CuqboUh+UUq2d7q8 hk3FqmkHCXmKlCth8zVSQqjGtWL66UXdPfQuIAVbX606xRFfOyHe0hCY4KqN3gGbUgb3 yCi8LGejj5V0oeqfl6WB37wd/ENLhMp08hXa5KCwzGA9adveE4aj4ZtxCx046DkwP/qG in3SjV0g6zIB6mmxnxc4dMjeLOswsrTRPh4B9uaQtWkXgZRc3Vzy7sbhXktQ9n+MoNzz Xx7NzCcGnaaU/3jVGbUsBi27DVz5GwJmmXO+3w/49UaC/0GgC2shn86oRV6lC5YlBaRy zTWA== X-Forwarded-Encrypted: i=1; AKwUvBwoTUlYdwoJfmdHvIUbysOoDveY6cjJTxGpLbBzfMk+Esbp+Ztw9p7GeXORaUE3TDPZ/tr7g3U=@vger.kernel.org X-Gm-Message-State: AFuF++kAdlDJVOtcA6Cu/I8pn49EIQ4Y6cB5WP+jzyZr66IhB0BaiF8V qC9xYqtrZc3ooQI0OqppetfohDAARpuEOCcK0pjq+alox/385t5bG6Sl8XuUlTaZmdXstQLwX72 f+qx7CQ== X-Received: from plhk18.prod.google.com ([2002:a17:902:d592:b0:2ca:ceab:34ae]) (user=kuniyu job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:f54b:b0:2d3:7c58:b0e1 with SMTP id d9443c01a7336-2d74ce307c7mr293912915ad.0.1788113357495; Sun, 30 Aug 2026 11:09:17 -0700 (PDT) Date: Sun, 30 Aug 2026 18:09:12 +0000 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.55.0.897.gb25b4bd76c-goog Message-ID: <20260830180915.260225-1-kuniyu@google.com> Subject: [PATCH v1 net] af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). From: Kuniyuki Iwashima To: Willem de Bruijn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni Cc: Simon Horman , Johann Baudy , Kuniyuki Iwashima , Kuniyuki Iwashima , netdev@vger.kernel.org, syzbot+73df3f89e1e13089e466@syzkaller.appspotmail.com Content-Type: text/plain; charset="UTF-8" syzbot reported BUG() in sock_sendmsg_nosec(). [0] The problem is that tpacket_parse_header() casts user-provided tpacket_hdr.tp_len, which is u32, to int. If the length is larger than INT_MAX, the following condition in tpacket_parse_header() passes, if (unlikely(tp_len > size_max)) and any negative value can be returned to the caller, up to sock_sendmsg_nosec(). The repro set tpacket_hdr.tp_len to 0xfffffdef, which is cast to -EIOCBQUEUED (-529), triggering BUG() in sock_sendmsg_nosec(). *(uint64_t*)0x200000000008 = 0xfffffdef; ... syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x200000000000ul, /*count=*/1ul); Let's define the local tp_len as u32 in tpacket_parse_header(). [0]: kernel BUG at net/socket.c:803! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 5628 Comm: syz-executor176 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:sock_sendmsg_nosec+0x145/0x180 net/socket.c:803 Code: 06 67 48 0f b9 3a eb 95 e8 e8 3a 22 f8 48 89 df 4c 89 f6 4c 89 e2 4d 89 fb 2e e8 32 a5 5c 16 e9 51 ff ff ff e8 cc 3a 22 f8 90 <0f> 0b e8 c4 3a 22 f8 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28 RSP: 0018:ffffc90003aefb48 EFLAGS: 00010293 RAX: ffffffff89a578d4 RBX: ffff8880764c67c0 RCX: ffff88807fb23e80 RDX: 0000000000000000 RSI: 00000000fffffdef RDI: 00000000fffffdef RBP: 00000000fffffdef R08: ffffc90003aef747 R09: 1ffff9200075dee8 R10: dffffc0000000000 R11: fffff5200075dee9 R12: 0000000000000001 R13: dffffc0000000000 R14: ffffc90003aefbc0 R15: ffffffff8aac4310 FS: 000055559101b400(0000) GS:ffff888124ce0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000210 CR3: 0000000073dca000 CR4: 00000000003526f0 Call Trace: __sock_sendmsg net/socket.c:815 [inline] sock_write_iter+0x2de/0x3e0 net/socket.c:1266 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f173130ecb9 Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd67e44248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f173130ecb9 RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000003 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd67e44388 R13: 0000000000000002 R14: 00002000000000c0 R15: 0000000000000002 Fixes: 69e3c75f4d54 ("net: TX_RING and packet mmap") Reported-by: syzbot+73df3f89e1e13089e466@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a946ffa.1d9ded08.62e62.0123.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima --- net/packet/af_packet.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index b22cda322136..76bde7906d49 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -2675,7 +2675,8 @@ static int tpacket_parse_header(struct packet_sock *po, void *frame, int size_max, void **data) { union tpacket_uhdr ph; - int tp_len, off; + u32 tp_len; + int off; ph.raw = frame; @@ -2695,7 +2696,7 @@ static int tpacket_parse_header(struct packet_sock *po, void *frame, break; } if (unlikely(tp_len > size_max)) { - pr_err("packet size is too long (%d > %d)\n", tp_len, size_max); + pr_err("packet size is too long (%u > %d)\n", tp_len, size_max); return -EMSGSIZE; } -- 2.55.0.897.gb25b4bd76c-goog