diff options
| author | Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> | 2022-10-01 19:43:44 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-10-26 14:25:23 +0300 |
| commit | 67cb80a9d2c83edac0e42aaa91ed4dd527cec284 (patch) | |
| tree | 89e80e690df6457ca9d42b6e74f174c5ed968ae4 /net/ieee802154 | |
| parent | 6cc0e2afc6a137d45b9523f61a1b1b16a68c9dc0 (diff) | |
| download | linux-67cb80a9d2c83edac0e42aaa91ed4dd527cec284.tar.xz | |
net/ieee802154: reject zero-sized raw_sendmsg()
[ Upstream commit 3a4d061c699bd3eedc80dc97a4b2a2e1af83c6f5 ]
syzbot is hitting skb_assert_len() warning at raw_sendmsg() for ieee802154
socket. What commit dc633700f00f726e ("net/af_packet: check len when
min_header_len equals to 0") does also applies to ieee802154 socket.
Link: https://syzkaller.appspot.com/bug?extid=5ea725c25d06fb9114c4
Reported-by: syzbot <syzbot+5ea725c25d06fb9114c4@syzkaller.appspotmail.com>
Fixes: fd1894224407c484 ("bpf: Don't redirect packets with invalid pkt_len")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/ieee802154')
| -rw-r--r-- | net/ieee802154/socket.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c index 7edec210780a..d4c162d63634 100644 --- a/net/ieee802154/socket.c +++ b/net/ieee802154/socket.c @@ -252,6 +252,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) return -EOPNOTSUPP; } + if (!size) + return -EINVAL; + lock_sock(sk); if (!sk->sk_bound_dev_if) dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154); |