Validate PACKET_RX_RING and PACKET_VERSION socket option value size.

Reported-by: syzbot+0e132bb052dcf3804e31@syzkaller.appspotmail.com
Reported-by: syzbot+8e48cb352eb08dc2c8ab@syzkaller.appspotmail.com
PiperOrigin-RevId: 723999333
This commit is contained in:
Ayush Ranjan
2025-02-06 11:04:23 -08:00
committed by gVisor bot
parent 902a56c6c5
commit d8518f2991
+6
View File
@@ -2721,6 +2721,9 @@ func setSockOptPacket(t *kernel.Task, s socket.Socket, ep commonEndpoint, name i
switch name {
case linux.PACKET_RX_RING:
var tpacketReq linux.TpacketReq
if len(optVal) < tpacketReq.SizeBytes() {
return syserr.ErrInvalidArgument
}
tpacketReq.UnmarshalBytes(optVal)
req := tcpip.TpacketReq{
TpBlockSize: tpacketReq.TpBlockSize,
@@ -2751,6 +2754,9 @@ func setSockOptPacket(t *kernel.Task, s socket.Socket, ep commonEndpoint, name i
}
return nil
case linux.PACKET_VERSION:
if len(optVal) < sizeOfInt32 {
return syserr.ErrInvalidArgument
}
v := hostarch.ByteOrder.Uint32(optVal)
return syserr.TranslateNetstackError(ep.SetSockOptInt(tcpip.PacketMMapVersionOption, int(v)))
default: