git: 668a555de619 - stable/13 - rip: Add missing minimum length validation in rip_output()

[Mark Johnston]

The branch stable/13 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=668a555de619f0894cb233f00f70dc19973c154f

commit 668a555de619f0894cb233f00f70dc19973c154f
Author:     Mark Johnston <markj at FreeBSD.org>
AuthorDate: 2021-07-26 20:39:18 +0000
Commit:     Mark Johnston <markj at FreeBSD.org>
CommitDate: 2021-08-02 19:01:11 +0000

    rip: Add missing minimum length validation in rip_output()
    
    If the socket is configured such that the sender is expected to supply
    the IP header, then we need to verify that it actually did so.
    
    Reported by:    syzkaller+KMSAN
    Reviewed by:    donner
    Sponsored by:   The FreeBSD Foundation
    
    (cherry picked from commit ba21825202737a8b7e90e1ef669c7fe7e7d50325)
---
 sys/netinet/raw_ip.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index 1db73a6da68c..996440227145 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -523,8 +523,15 @@ rip_output(struct mbuf *m, struct socket *so, ...)
 	} else {
 		if (m->m_pkthdr.len > IP_MAXPACKET) {
 			m_freem(m);
-			return(EMSGSIZE);
+			return (EMSGSIZE);
 		}
+		if (m->m_pkthdr.len < sizeof(*ip)) {
+			m_freem(m);
+			return (EINVAL);
+		}
+		m = m_pullup(m, sizeof(*ip));
+		if (m == NULL)
+			return (ENOMEM);
 		ip = mtod(m, struct ip *);
 		hlen = ip->ip_hl << 2;
 		if (m->m_len < hlen) {