| From 4576cd469d980317c4edd9173f8b694aa71ea3a3 Mon Sep 17 00:00:00 2001 |
| From: Willem de Bruijn <willemb@google.com> |
| Date: Mon, 6 Aug 2018 10:38:34 -0400 |
| Subject: packet: refine ring v3 block size test to hold one frame |
| |
| From: Willem de Bruijn <willemb@google.com> |
| |
| commit 4576cd469d980317c4edd9173f8b694aa71ea3a3 upstream. |
| |
| TPACKET_V3 stores variable length frames in fixed length blocks. |
| Blocks must be able to store a block header, optional private space |
| and at least one minimum sized frame. |
| |
| Frames, even for a zero snaplen packet, store metadata headers and |
| optional reserved space. |
| |
| In the block size bounds check, ensure that the frame of the |
| chosen configuration fits. This includes sockaddr_ll and optional |
| tp_reserve. |
| |
| Syzbot was able to construct a ring with insuffient room for the |
| sockaddr_ll in the header of a zero-length frame, triggering an |
| out-of-bounds write in dev_parse_header. |
| |
| Convert the comparison to less than, as zero is a valid snap len. |
| This matches the test for minimum tp_frame_size immediately below. |
| |
| Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") |
| Fixes: eb73190f4fbe ("net/packet: refine check for priv area size") |
| Reported-by: syzbot <syzkaller@googlegroups.com> |
| Signed-off-by: Willem de Bruijn <willemb@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/packet/af_packet.c | 10 ++++++---- |
| 1 file changed, 6 insertions(+), 4 deletions(-) |
| |
| --- a/net/packet/af_packet.c |
| +++ b/net/packet/af_packet.c |
| @@ -4275,6 +4275,8 @@ static int packet_set_ring(struct sock * |
| } |
| |
| if (req->tp_block_nr) { |
| + unsigned int min_frame_size; |
| + |
| /* Sanity tests and some calculations */ |
| err = -EBUSY; |
| if (unlikely(rb->pg_vec)) |
| @@ -4297,12 +4299,12 @@ static int packet_set_ring(struct sock * |
| goto out; |
| if (unlikely(!PAGE_ALIGNED(req->tp_block_size))) |
| goto out; |
| + min_frame_size = po->tp_hdrlen + po->tp_reserve; |
| if (po->tp_version >= TPACKET_V3 && |
| - req->tp_block_size <= |
| - BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr)) |
| + req->tp_block_size < |
| + BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + min_frame_size) |
| goto out; |
| - if (unlikely(req->tp_frame_size < po->tp_hdrlen + |
| - po->tp_reserve)) |
| + if (unlikely(req->tp_frame_size < min_frame_size)) |
| goto out; |
| if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1))) |
| goto out; |