From: Jakub Kicinski Date: Wed, 18 Dec 2024 02:44:00 +0000 (-0800) Subject: net: netlink: catch attempts to send empty messages X-Git-Tag: v6.14-rc1~162^2~182 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=75e2c86c7b180fd1068ad271178c2820a199e7eb;p=thirdparty%2Fkernel%2Flinux.git net: netlink: catch attempts to send empty messages syzbot can figure out a way to redirect a netlink message to a tap. Sending empty skbs to devices is not valid and we end up hitting a skb_assert_len() in __dev_queue_xmit(). Make catching these mistakes easier, assert the skb size directly in netlink core. Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20241218024400.824355-1-kuba@kernel.org Signed-off-by: Jakub Kicinski --- diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index f4e7b5e4bb59f..85311226183a2 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -1287,6 +1287,7 @@ static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation) { int delta; + skb_assert_len(skb); WARN_ON(skb->sk != NULL); delta = skb->end - skb->tail; if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize)