From 6fda48f50dcd262f326c1ce0bf4ed067efec4996 Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@gmail.com>
Date: Tue, 7 Jun 2022 13:26:08 -0700
Subject: [PATCH] tcpip/transport/raw: check MTU before copying a buffer from
 user memory

Reported-by: syzbot+5cccbb7c0511ad1aa175@syzkaller.appspotmail.com
---
 pkg/tcpip/transport/internal/network/endpoint.go | 4 ++++
 pkg/tcpip/transport/raw/endpoint.go              | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/pkg/tcpip/transport/internal/network/endpoint.go b/pkg/tcpip/transport/internal/network/endpoint.go
index 27ae08634..b70080b1c 100644
--- a/pkg/tcpip/transport/internal/network/endpoint.go
+++ b/pkg/tcpip/transport/internal/network/endpoint.go
@@ -235,6 +235,10 @@ type WriteContext struct {
 	tos   uint8
 }
 
+func (c *WriteContext) MTU() uint32 {
+	return c.route.MTU()
+}
+
 // Release releases held resources.
 func (c *WriteContext) Release() {
 	c.route.Release()
diff --git a/pkg/tcpip/transport/raw/endpoint.go b/pkg/tcpip/transport/raw/endpoint.go
index bdf274caf..131a94734 100644
--- a/pkg/tcpip/transport/raw/endpoint.go
+++ b/pkg/tcpip/transport/raw/endpoint.go
@@ -345,6 +345,10 @@ func (e *endpoint) write(p tcpip.Payloader, opts tcpip.WriteOptions) (int64, tcp
 		return 0, err
 	}
 
+	if p.Len() > int(ctx.MTU()) {
+		return 0, &tcpip.ErrMessageTooLong{}
+	}
+
 	// TODO(https://gvisor.dev/issue/6538): Avoid this allocation.
 	payloadBytes := make([]byte, p.Len())
 	if _, err := io.ReadFull(p, payloadBytes); err != nil {