From d8518f299131cc7a016e8c119f842131d7839a6c Mon Sep 17 00:00:00 2001 From: Ayush Ranjan Date: Thu, 6 Feb 2025 10:59:49 -0800 Subject: [PATCH] Validate PACKET_RX_RING and PACKET_VERSION socket option value size. Reported-by: syzbot+0e132bb052dcf3804e31@syzkaller.appspotmail.com Reported-by: syzbot+8e48cb352eb08dc2c8ab@syzkaller.appspotmail.com PiperOrigin-RevId: 723999333 --- pkg/sentry/socket/netstack/netstack.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkg/sentry/socket/netstack/netstack.go b/pkg/sentry/socket/netstack/netstack.go index f94e1a860..356b82237 100644 --- a/pkg/sentry/socket/netstack/netstack.go +++ b/pkg/sentry/socket/netstack/netstack.go @@ -2721,6 +2721,9 @@ func setSockOptPacket(t *kernel.Task, s socket.Socket, ep commonEndpoint, name i switch name { case linux.PACKET_RX_RING: var tpacketReq linux.TpacketReq + if len(optVal) < tpacketReq.SizeBytes() { + return syserr.ErrInvalidArgument + } tpacketReq.UnmarshalBytes(optVal) req := tcpip.TpacketReq{ TpBlockSize: tpacketReq.TpBlockSize, @@ -2751,6 +2754,9 @@ func setSockOptPacket(t *kernel.Task, s socket.Socket, ep commonEndpoint, name i } return nil case linux.PACKET_VERSION: + if len(optVal) < sizeOfInt32 { + return syserr.ErrInvalidArgument + } v := hostarch.ByteOrder.Uint32(optVal) return syserr.TranslateNetstackError(ep.SetSockOptInt(tcpip.PacketMMapVersionOption, int(v))) default: