[src/trunk]: src/sys/net As I suspected, the KASSERT I added yesterday can fi...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/11ad290b226d
branches:  trunk
changeset: 965328:11ad290b226d
user:      maxv <maxv%NetBSD.org@localhost>
date:      Fri Sep 13 06:39:29 2019 +0000

description:
As I suspected, the KASSERT I added yesterday can fire if we try to process
zero-sized packets. Skip them to prevent a type confusion that can trigger
random page faults later.

Reported-by: syzbot+3e447ebdcb2bcfa402ac%syzkaller.appspotmail.com@localhost

diffstat:

 sys/net/bpf.c |  9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diffs (30 lines):

diff -r 2990d507bdb9 -r 11ad290b226d sys/net/bpf.c
--- a/sys/net/bpf.c     Fri Sep 13 06:30:10 2019 +0000
+++ b/sys/net/bpf.c     Fri Sep 13 06:39:29 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: bpf.c,v 1.230 2019/09/12 07:38:19 maxv Exp $   */
+/*     $NetBSD: bpf.c,v 1.231 2019/09/13 06:39:29 maxv Exp $   */
 
 /*
  * Copyright (c) 1990, 1991, 1993
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: bpf.c,v 1.230 2019/09/12 07:38:19 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: bpf.c,v 1.231 2019/09/13 06:39:29 maxv Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_bpf.h"
@@ -1676,6 +1676,11 @@
 
        pktlen = m_length(m);
 
+       /* Skip zero-sized packets. */
+       if (__predict_false(pktlen == 0)) {
+               return;
+       }
+
        if (pktlen == m->m_len) {
                cpfn = (void *)memcpy;
                marg = mtod(m, void *);