Syzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any skbs, that is, the flow->head is null. The root cause, as the [2] says, is because that bpf_prog_test_run_skb() run a bpf prog which redirects empty skbs. So we should determine whether the length of the packet modified by bpf prog or others like bpf_prog_test is valid before forwarding it directly. LINK: [1] https://syzkaller.appspot.com/bug?id=0b84da80c2917757915afa89f7738a9d16ec96c5 LINK: [2] https://www.spinics.net/lists/netdev/msg777503.html Reported-by: syzbot+7a12909485b94426aceb@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Zhengchao Shao <shaozhengchao@xxxxxxxxxx> --- net/core/filter.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 4ef77ec5255e..27801b314960 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2122,6 +2122,11 @@ static int __bpf_redirect_no_mac(struct sk_buff *skb, struct net_device *dev, { unsigned int mlen = skb_network_offset(skb); + if (unlikely(skb->len == 0)) { + kfree_skb(skb); + return -EINVAL; + } + if (mlen) { __skb_pull(skb, mlen); @@ -2143,7 +2148,9 @@ static int __bpf_redirect_common(struct sk_buff *skb, struct net_device *dev, u32 flags) { /* Verify that a link layer header is carried */ - if (unlikely(skb->mac_header >= skb->network_header)) { + if (unlikely(skb->mac_header >= skb->network_header) || + (min_t(u32, skb_mac_header_len(skb), skb->len) < + (u32)dev->min_header_len)) { kfree_skb(skb); return -ERANGE; } -- 2.17.1
