4.4-stable patches

added patches:
	net-packet-fix-overflow-in-check-for-priv-area-size.patch

diff --git a/queue-4.4/net-packet-fix-overflow-in-check-for-priv-area-size.patch b/queue-4.4/net-packet-fix-overflow-in-check-for-priv-area-size.patch
new file mode 100644 (file)
index 0000000..7f7907b
--- /dev/null
+++ b/queue-4.4/net-packet-fix-overflow-in-check-for-priv-area-size.patch
@@ -0,0 +1,40 @@
+From 2b6867c2ce76c596676bec7d2d525af525fdc6e2 Mon Sep 17 00:00:00 2001
+From: Andrey Konovalov <andreyknvl@google.com>
+Date: Wed, 29 Mar 2017 16:11:20 +0200
+Subject: net/packet: fix overflow in check for priv area size
+
+From: Andrey Konovalov <andreyknvl@google.com>
+
+commit 2b6867c2ce76c596676bec7d2d525af525fdc6e2 upstream.
+
+Subtracting tp_sizeof_priv from tp_block_size and casting to int
+to check whether one is less then the other doesn't always work
+(both of them are unsigned ints).
+
+Compare them as is instead.
+
+Also cast tp_sizeof_priv to u64 before using BLK_PLUS_PRIV, as
+it can overflow inside BLK_PLUS_PRIV otherwise.
+
+Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/packet/af_packet.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4138,8 +4138,8 @@ static int packet_set_ring(struct sock *
+               if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
+                       goto out;
+               if (po->tp_version >= TPACKET_V3 &&
+-                  (int)(req->tp_block_size -
+-                        BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0)
++                  req->tp_block_size <=
++                        BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
+                       goto out;
+               if (unlikely(req->tp_frame_size < po->tp_hdrlen +
+                                       po->tp_reserve))

diff --git a/queue-4.4/series b/queue-4.4/series
index e4301aa47e46a4e1420eba3083287e25972e0664..e61bafc1a08b986a70f13cb819db71ace7257558 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -9,3 +9,4 @@ mips-switch-to-the-irq_stack-in-interrupts.patch
 mips-select-have_irq_exit_on_irq_stack.patch
 mips-irq-stack-fix-erroneous-jal-to-plat_irq_dispatch.patch
 crypto-caam-fix-rng-deinstantiation-error-checking.patch
+net-packet-fix-overflow-in-check-for-priv-area-size.patch