Message ID | 20180806143834.121959-1-willemdebruijn.kernel@gmail.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
Series | [net] packet: refine ring v3 block size test to hold one frame | expand |
From: Willem de Bruijn <willemdebruijn.kernel@gmail.com> Date: Mon, 6 Aug 2018 10:38:34 -0400 > From: Willem de Bruijn <willemb@google.com> > > TPACKET_V3 stores variable length frames in fixed length blocks. > Blocks must be able to store a block header, optional private space > and at least one minimum sized frame. > > Frames, even for a zero snaplen packet, store metadata headers and > optional reserved space. > > In the block size bounds check, ensure that the frame of the > chosen configuration fits. This includes sockaddr_ll and optional > tp_reserve. > > Syzbot was able to construct a ring with insuffient room for the > sockaddr_ll in the header of a zero-length frame, triggering an > out-of-bounds write in dev_parse_header. > > Convert the comparison to less than, as zero is a valid snap len. > This matches the test for minimum tp_frame_size immediately below. > > Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") > Fixes: eb73190f4fbe ("net/packet: refine check for priv area size") > Reported-by: syzbot <syzkaller@googlegroups.com> > Signed-off-by: Willem de Bruijn <willemb@google.com> Good catch, applied and queued up for -stable, thanks.
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 9b27d0cd766d5..e6445d8f3f57f 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -4226,6 +4226,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, } if (req->tp_block_nr) { + unsigned int min_frame_size; + /* Sanity tests and some calculations */ err = -EBUSY; if (unlikely(rb->pg_vec)) @@ -4248,12 +4250,12 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, goto out; if (unlikely(!PAGE_ALIGNED(req->tp_block_size))) goto out; + min_frame_size = po->tp_hdrlen + po->tp_reserve; if (po->tp_version >= TPACKET_V3 && - req->tp_block_size <= - BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr)) + req->tp_block_size < + BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + min_frame_size) goto out; - if (unlikely(req->tp_frame_size < po->tp_hdrlen + - po->tp_reserve)) + if (unlikely(req->tp_frame_size < min_frame_size)) goto out; if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1))) goto out;