net/af_packet: check len when min_header_len equals to 0
stable inclusion from stable-v5.10.141 commit 4931af31c402b20c528b43d90f98bc6f4bcb5810 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I685FC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4931af31c402b20c528b43d90f98bc6f4bcb5810 -------------------------------- commit dc633700 upstream. User can use AF_PACKET socket to send packets with the length of 0. When min_header_len equals to 0, packet_snd will call __dev_queue_xmit to send packets, and sock->type can be any type. Reported-by:<syzbot+5ea725c25d06fb9114c4@syzkaller.appspotmail.com> Fixes: fd189422 ("bpf: Don't redirect packets with invalid pkt_len") Signed-off-by:
Zhengchao Shao <shaozhengchao@huawei.com> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
Jialin Zhang <zhangjialin11@huawei.com> Reviewed-by:
Zheng Zengkai <zhengzengkai@huawei.com>
Loading
Please sign in to comment