Tetsuo Handa 34f31a2b66 net/ieee802154: don't warn zero-sized raw_sendmsg() ... [ Upstream commit b12e924a2f ] syzbot is hitting skb_assert_len() warning at __dev_queue_xmit() [1], for PF_IEEE802154 socket's zero-sized raw_sendmsg() request is hitting __dev_queue_xmit() with skb->len == 0. Since PF_IEEE802154 socket's zero-sized raw_sendmsg() request was able to return 0, don't call __dev_queue_xmit() if packet length is 0. ---------- #include <sys/socket.h> #include <netinet/in.h> int main(int argc, char *argv[]) { struct sockaddr_in addr = { .sin_family = AF_INET, .sin_addr.s_addr = htonl(INADDR_LOOPBACK) }; struct iovec iov = { }; struct msghdr hdr = { .msg_name = &addr, .msg_namelen = sizeof(addr), .msg_iov = &iov, .msg_iovlen = 1 }; sendmsg(socket(PF_IEEE802154, SOCK_RAW, 0), &hdr, 0); return 0; } ---------- Note that this might be a sign that commit fd18942244 ("bpf: Don't redirect packets with invalid pkt_len") should be reverted, for skb->len == 0 was acceptable for at least PF_IEEE802154 socket. Link: https://syzkaller.appspot.com/bug?extid=5ea725c25d06fb9114c4 [1] Reported-by: syzbot <syzbot+5ea725c25d06fb9114c4@syzkaller.appspotmail.com> Fixes: fd18942244 ("bpf: Don't redirect packets with invalid pkt_len") Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: Alexander Aring <aahringo@redhat.com> Link: https://lore.kernel.org/r/20221005014750.3685555-2-aahringo@redhat.com Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-10-26 12:35:55 +02:00
..
6lowpan	6lowpan: iphc: Fix an off-by-one check of array index	2021-07-22 16:19:03 +02:00
9p	net/9p: Initialize the iounit field during fid creation	2022-08-17 14:24:23 +02:00
802	net: 802: remove dead leftover after ipx driver removal	2021-08-13 16:30:35 -07:00
8021q	net: use eth_hw_addr_set() instead of ether_addr_copy()	2022-08-31 17:16:37 +02:00
appletalk	net: socket: rework compat_ifreq_ioctl()	2021-07-23 14:20:25 +01:00
atm	…
ax25	net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg	2022-06-22 14:22:01 +02:00
batman-adv	batman-adv: Use netif_rx_any_context() any.	2022-07-29 17:25:07 +02:00
bluetooth	Bluetooth: L2CAP: Fix user-after-free	2022-10-26 12:35:37 +02:00
bpf	bpf: Don't redirect packets with invalid pkt_len	2022-09-05 10:30:07 +02:00
bpfilter	bpfilter: Specify the log level for the kmsg message	2021-06-25 13:13:50 +02:00
bridge	netfilter: ebtables: fix memory leak when blob is malformed	2022-09-28 11:11:52 +02:00
caif	net-caif: avoid user-triggerable WARN_ON(1)	2021-09-14 12:51:15 +01:00
can	can: bcm: check the result of can_send() in bcm_can_tx()	2022-10-26 12:35:36 +02:00
ceph	libceph: fix potential use-after-free on linger ping and resends	2022-05-25 09:57:28 +02:00
core	net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory	2022-10-26 12:35:37 +02:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-08 19:12:52 +01:00
dccp	dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock	2022-08-17 14:23:37 +02:00
decnet	net: Fix data-races around sysctl_[rw]mem(_offset)?.	2022-08-03 12:03:51 +02:00
dns_resolver	…
dsa	net: dsa: hellcreek: Print warning only once	2022-09-20 12:39:45 +02:00
ethernet	move netdev_boot_setup into Space.c	2021-08-03 13:05:26 +01:00
ethtool	ethtool: Fix get module eeprom fallback	2022-06-29 09:03:23 +02:00
hsr	net: use eth_hw_addr_set() instead of ether_addr_copy()	2022-08-31 17:16:37 +02:00
ieee802154	net/ieee802154: don't warn zero-sized raw_sendmsg()	2022-10-26 12:35:55 +02:00
ife	…
ipv4	tcp: annotate data-race around tcp_md5sig_pool_populated	2022-10-26 12:35:33 +02:00
ipv6	netfilter: nft_fib: Fix for rpath check with VRF devices	2022-10-26 12:34:47 +02:00
iucv	net/iucv: Replace deprecated CPU-hotplug functions.	2021-08-09 10:13:32 +01:00
kcm	kcm: fix strp_init() order and cleanup	2022-09-08 12:28:03 +02:00
key	af_key: Do not call xfrm_probe_algs in parallel	2022-08-31 17:16:36 +02:00
l2tp	ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg	2022-06-22 14:21:58 +02:00
l3mdev	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu	2022-04-27 14:38:53 +02:00
lapb	…
llc	llc: only change llc->dev when bind() succeeds	2022-03-28 09:58:46 +02:00
mac80211	wifi: mac80211: allow bw change during channel switch in mesh	2022-10-26 12:34:39 +02:00
mac802154	net: mac802154: Fix a condition in the receive path	2022-09-08 12:28:07 +02:00
mctp	mctp: Fix check for dev_hard_header() result	2022-04-13 20:59:16 +02:00
mpls	net: Use u64_stats_fetch_begin_irq() for stats fetch.	2022-09-08 12:28:07 +02:00
mptcp	mptcp: Fix crash due to tcp_tsorted_anchor was initialized before release skb	2022-08-31 17:16:50 +02:00
ncsi	net/ncsi: check for error return from call to nla_put_u32	2022-01-05 12:42:37 +01:00
netfilter	netfilter: conntrack: revisit the gc initial rescheduling bias	2022-10-26 12:34:45 +02:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-04-13 20:59:10 +02:00
netlink	net: genl: fix error path memory leak in policy dumping	2022-08-25 11:40:25 +02:00
netrom	netrom: fix api breakage in nr_setsockopt()	2022-01-27 11:04:00 +01:00
nfc	NFC: NULL out the dev->rfkill to prevent UAF	2022-06-09 10:22:46 +02:00
nsh	…
openvswitch	openvswitch: Fix overreporting of drops in dropwatch	2022-10-26 12:35:33 +02:00
packet	net/af_packet: check len when min_header_len equals to 0	2022-09-05 10:30:12 +02:00
phonet	phonet: refcount leak in pep_sock_accep	2022-01-11 15:35:16 +01:00
psample	…
qrtr	net: qrtr: start MHI channel after endpoit creation	2022-08-25 11:40:29 +02:00
rds	net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()	2022-10-26 12:34:49 +02:00
rfkill	rfkill: make new event layout opt-in	2022-04-08 14:23:00 +02:00
rose	rose: check NULL rose_loopback_neigh->loopback	2022-08-31 17:16:38 +02:00
rxrpc	rxrpc: Fix calc of resend age	2022-09-23 14:15:50 +02:00
sched	net: sched: act_ct: fix possible refcount leak in tcf_ct_init()	2022-10-05 10:39:42 +02:00
sctp	sctp: handle the error returned from sctp_auth_asoc_init_active_key	2022-10-26 12:34:48 +02:00
smc	net/smc: Stop the CLC flow if no link to map buffers on	2022-09-28 11:11:53 +02:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-18 19:17:11 +01:00
sunrpc	SUNRPC: RPC level errors should set task->tk_rpc_status	2022-08-31 17:16:37 +02:00
switchdev	net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge	2021-08-04 12:35:07 +01:00
tipc	tipc: fix shift wrapping bug in map_get()	2022-09-15 11:30:05 +02:00
tls	net/tls: Remove the context from the list in tls_device_down	2022-08-03 12:03:47 +02:00
unix	io_uring/af_unix: defer registered files gc to io_uring release	2022-10-26 12:35:52 +02:00
vmw_vsock	vhost/vsock: Use kvmalloc/kvfree for larger packets.	2022-10-26 12:34:47 +02:00
wireless	wifi: cfg80211: update hidden BSSes to avoid WARN_ON	2022-10-15 07:59:03 +02:00
x25	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-04-08 14:23:53 +02:00
xdp	xsk: Fix backpressure mechanism on Tx	2022-10-26 12:34:40 +02:00
xfrm	xfrm: Update ipcomp_scratches with NULL when freed	2022-10-26 12:35:34 +02:00
Kconfig	mctp: Add MCTP base	2021-07-29 15:06:49 +01:00
Makefile	mctp: Add MCTP base	2021-07-29 15:06:49 +01:00
compat.c	…
devres.c	net: devres: Correct a grammatical error	2021-06-11 12:55:28 -07:00
socket.c	net: Fix a data-race around sysctl_somaxconn.	2022-08-31 17:16:45 +02:00
sysctl_net.c	…