From: Willem de Bruijn <willemdebruijn.ker...@gmail.com>
Date: Mon, 6 Aug 2018 10:38:34 -0400
> From: Willem de Bruijn <will...@google.com>
>
> TPACKET_V3 stores variable length frames in fixed length blocks.
> Blocks must be able to store a block header, optional private space
> and at least one minimum sized frame.
>
> Frames, even for a zero snaplen packet, store metadata headers and
> optional reserved space.
>
> In the block size bounds check, ensure that the frame of the
> chosen configuration fits. This includes sockaddr_ll and optional
> tp_reserve.
>
> Syzbot was able to construct a ring with insuffient room for the
> sockaddr_ll in the header of a zero-length frame, triggering an
> out-of-bounds write in dev_parse_header.
>
> Convert the comparison to less than, as zero is a valid snap len.
> This matches the test for minimum tp_frame_size immediately below.
>
> Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
> Fixes: eb73190f4fbe ("net/packet: refine check for priv area size")
> Reported-by: syzbot <syzkal...@googlegroups.com>
> Signed-off-by: Willem de Bruijn <will...@google.com>
Good catch, applied and queued up for -stable, thanks.
