Re: [PATCH net] af_packet: Don't send zero-byte data in tpacket_snd().

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 8/10/26 11:04 PM, Eric Dumazet wrote:
> syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():
>
> skb_assert_len
> WARNING: at include/linux/skbuff.h:2753 skb_assert_len
> WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781
>
> Call Trace:
>   <TASK>
>   dev_queue_xmit include/linux/netdevice.h:3448 [inline]
>   packet_xmit+0x243/0x310 net/packet/af_packet.c:276
>   tpacket_snd net/packet/af_packet.c:2907 [inline]
>   packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134
>
> When sending 0-byte packets via TPACKET ring buffer on devices with no
> hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb()
> populates an skb with skb->len == 0 and returns 0. tpacket_snd() then
> forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to
> hit skb_assert_len(skb).
>
> Similar checks exist in packet_snd() via commit dc633700f00f
> ("net/af_packet: check len when min_header_len equals to 0") and in
> packet_sendmsg_spkt() via commit 6a341729fb31 ("af_packet: Don't send
> zero-byte data in packet_sendmsg_spkt().").
>
> Return -EINVAL in tpacket_fill_skb() when skb->len is zero to reject
> zero-length packets in tpacket_snd().
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+30b93b6845b19cc38581@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a79e807.01d0871a.3a0d52.00ac.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>


Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>

Fixes: 69e3c75f4d54 ("net: TX_RING and packet mmap") would be more 
accurate but it makes no difference for backports.


> ---
>   net/packet/af_packet.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
> index 435756877abaa1ab4c0edcc2346bcb2de3625605..103025c4625fb317e0ecedd12c15857af86b7a65 100644
> --- a/net/packet/af_packet.c
> +++ b/net/packet/af_packet.c
> @@ -2660,6 +2660,9 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
>   		len = ((to_write > len_max) ? len_max : to_write);
>   	}
>   
> +	if (unlikely(!skb->len))
> +		return -EINVAL;
> +
>   	packet_parse_headers(skb, sock);
>   
>   	return tp_len;