diff options
author | Willem de Bruijn <willemb@google.com> | 2018-08-06 10:38:34 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2018-08-06 13:48:33 -0700 |
commit | 4576cd469d980317c4edd9173f8b694aa71ea3a3 (patch) | |
tree | a5d25cfbaa8b5ca12b8a1c3c6094326c220a786a /Documentation/livepatch | |
parent | 82a40777de12728dedf4075453b694f0d1baee80 (diff) | |
download | blackbird-op-linux-4576cd469d980317c4edd9173f8b694aa71ea3a3.tar.gz blackbird-op-linux-4576cd469d980317c4edd9173f8b694aa71ea3a3.zip |
packet: refine ring v3 block size test to hold one frame
TPACKET_V3 stores variable length frames in fixed length blocks.
Blocks must be able to store a block header, optional private space
and at least one minimum sized frame.
Frames, even for a zero snaplen packet, store metadata headers and
optional reserved space.
In the block size bounds check, ensure that the frame of the
chosen configuration fits. This includes sockaddr_ll and optional
tp_reserve.
Syzbot was able to construct a ring with insuffient room for the
sockaddr_ll in the header of a zero-length frame, triggering an
out-of-bounds write in dev_parse_header.
Convert the comparison to less than, as zero is a valid snap len.
This matches the test for minimum tp_frame_size immediately below.
Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
Fixes: eb73190f4fbe ("net/packet: refine check for priv area size")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'Documentation/livepatch')
0 files changed, 0 insertions, 0 deletions