Commit 3a4d061c authored by Tetsuo Handa's avatar Tetsuo Handa Committed by David S. Miller
Browse files

net/ieee802154: reject zero-sized raw_sendmsg() 

syzbot is hitting skb_assert_len() warning at raw_sendmsg() for ieee802154
socket. What commit dc633700 ("net/af_packet: check len when
min_header_len equals to 0") does also applies to ieee802154 socket.

Link: https://syzkaller.appspot.com/bug?extid=5ea725c25d06fb9114c4


Reported-by: default avatarsyzbot <syzbot+5ea725c25d06fb9114c4@syzkaller.appspotmail.com>
Fixes: fd189422 ("bpf: Don't redirect packets with invalid pkt_len")
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ba0fbdb9

net/ieee802154/socket.c

+3 −0
Original line number Diff line number Diff line
@@ -251,6 +251,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) 
		return -EOPNOTSUPP;

	}



	if (!size)

		return -EINVAL;



	lock_sock(sk);

	if (!sk->sk_bound_dev_if)

		dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154);