net/ieee802154: reject zero-sized raw_sendmsg()

[ Upstream commit ae6d6e494ba8f21fc08d2bbb7bad972a2ad5fe2f ]

syzbot is hitting skb_assert_len() warning at raw_sendmsg() for ieee802154
socket. What commit bd546befdcd9e451 ("net/af_packet: check len when
min_header_len equals to 0") does also applies to ieee802154 socket.

Link: https://syzkaller.appspot.com/bug?extid=5ea725c25d06fb9114c4
Reported-by: syzbot <syzbot+5ea725c25d06fb9114c4@syzkaller.appspotmail.com>
Fixes: 214de3de5b084df0 ("bpf: Don't redirect packets with invalid pkt_len")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index a92b11999e5f259291c95fa72547bd1a2f3ef2b3..72637d5994d83dfeeca5bb858ac5070bf8a0a0e5 100644 (file)
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -252,6 +252,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
                return -EOPNOTSUPP;
        }
 
+       if (!size)
+               return -EINVAL;
+
        lock_sock(sk);
        if (!sk->sk_bound_dev_if)
                dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154);