On Fri, Dec 21, 2018 at 12:06:59PM -0500, Willem de Bruijn wrote: > From: Willem de Bruijn <will...@google.com> > > Packet sockets with SOCK_DGRAM may pass an address for use in > dev_hard_header. Ensure that it is of sufficient length. > > Reported-by: syzbot <syzkal...@googlegroups.com> > Signed-off-by: Willem de Bruijn <will...@google.com>
Willem, We use mausezahn [1] in some of the tests under tools/testing/selftests/net/forwarding/ and I started observing failures today. Bisected it down to this patch. It seems that mausezahn passes 'sll_halen=0' [2]. Can you please take a look and adjust the check? Thanks [1] https://github.com/netsniff-ng/netsniff-ng [2] With patch: # strace -e network mausezahn dummy0 -c 1 -p 64 -a de:ad:be:ef:13:37 -t ip -q socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_PACKET, SOCK_RAW, 768) = 3 setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_PACKET, SOCK_RAW, 768) = 3 setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0 sendto(3, "\377\377\377\377\377\377\336\255\276\357\0237\10\0E\0\0T\0\0\0\0\377\0\273\252\377\377\377\377\377\377"..., 98, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("dummy0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = -1 EINVAL (Invalid argument) +++ exited with 0 +++ Without patch: # strace -e network mausezahn dummy0 -c 1 -p 64 -a de:ad:be:ef:13:37 -t ip -q socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_PACKET, SOCK_RAW, 768) = 3 setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 4 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 socket(AF_PACKET, SOCK_RAW, 768) = 3 setsockopt(3, SOL_SOCKET, SO_BROADCAST, [1], 4) = 0 sendto(3, "\377\377\377\377\377\377\336\255\276\357\0237\10\0E\0\0T\0\0\0\0\377\0\273\252\377\377\377\377\377\377"..., 98, 0, {sa_family=AF_PACKET, sll_protocol=htons(ETH_P_ALL), sll_ifindex=if_nametoindex("dummy0"), sll_hatype=ARPHRD_NETROM, sll_pkttype=PACKET_HOST, sll_halen=0}, 20) = 98 +++ exited with 0 +++
