kernel: update to 4.14.206

[people/pmueller/ipfire-2.x.git] / src / patches / linux / linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch

diff --git a/src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch b/src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch
deleted file mode 100644 (file)
index a3eb323..0000000
--- a/src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
-
-patch based on acf69c946233259ab4d64f8869d4037a198c7f06
-From: Or Cohen <orcohen@paloaltonetworks.com>
-Subject: net/packet: fix overflow in tpacket_rcv
-
-Using tp_reserve to calculate netoff can overflow as
-tp_reserve is unsigned int and netoff is unsigned short.
-
-This may lead to macoff receving a smaller value then
-sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr
-is set, an out-of-bounds write will occur when
-calling virtio_net_hdr_from_skb.
-
-The bug is fixed by converting netoff to unsigned int
-and checking if it exceeds USHRT_MAX.
-
-This addresses CVE-2020-14386
-
-
-diff -Naur linux-4.14.197.org/net/packet/af_packet.c linux-4.14.197/net/packet/af_packet.c
---- linux-4.14.197.org/net/packet/af_packet.c  2020-09-11 22:27:31.003458577 +0200
-+++ linux-4.14.197/net/packet/af_packet.c      2020-09-11 22:38:53.104021712 +0200
-@@ -2201,7 +2201,8 @@
-       int skb_len = skb->len;
-       unsigned int snaplen, res;
-       unsigned long status = TP_STATUS_USER;
--      unsigned short macoff, netoff, hdrlen;
-+      unsigned short macoff, hdrlen;
-+      unsigned int netoff;
-       struct sk_buff *copy_skb = NULL;
-       struct timespec ts;
-       __u32 ts_status;
-@@ -2264,6 +2265,10 @@
-               }
-               macoff = netoff - maclen;
-       }
-+      if (netoff > USHRT_MAX) {
-+              po->stats.stats1.tp_drops++;
-+              goto drop_n_restore;
-+      }
-       if (po->tp_version <= TPACKET_V2) {
-               if (macoff + snaplen > po->rx_ring.frame_size) {
-                       if (po->copy_thresh &&