Skip to content

Commit

Permalink
net/ieee802154: reject zero-sized raw_sendmsg()
Browse files Browse the repository at this point in the history
syzbot is hitting skb_assert_len() warning at raw_sendmsg() for ieee802154
socket. What commit dc63370 ("net/af_packet: check len when
min_header_len equals to 0") does also applies to ieee802154 socket.

Link: https://syzkaller.appspot.com/bug?extid=5ea725c25d06fb9114c4
Reported-by: syzbot <syzbot+5ea725c25d06fb9114c4@syzkaller.appspotmail.com>
Fixes: fd18942 ("bpf: Don't redirect packets with invalid pkt_len")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Tetsuo Handa authored and David S. Miller committed Oct 3, 2022
1 parent ba0fbdb commit 3a4d061
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions net/ieee802154/socket.c
Original file line number Diff line number Diff line change
Expand Up @@ -251,6 +251,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
return -EOPNOTSUPP;
}

if (!size)
return -EINVAL;

lock_sock(sk);
if (!sk->sk_bound_dev_if)
dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154);
Expand Down

0 comments on commit 3a4d061

Please sign in to comment.