From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 14 Apr 2017 09:07:34 +0000 (+0200)
Subject: 4.4-stable patches
X-Git-Tag: v4.10.11~10
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=30e83f5e65f002d63326224fd00bcc12ff85a4b1;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	net-packet-fix-overflow-in-check-for-priv-area-size.patch
---

diff --git a/queue-4.4/net-packet-fix-overflow-in-check-for-priv-area-size.patch b/queue-4.4/net-packet-fix-overflow-in-check-for-priv-area-size.patch
new file mode 100644
index 00000000000..7f7907be7d3
--- /dev/null
+++ b/queue-4.4/net-packet-fix-overflow-in-check-for-priv-area-size.patch
@@ -0,0 +1,40 @@
+From 2b6867c2ce76c596676bec7d2d525af525fdc6e2 Mon Sep 17 00:00:00 2001
+From: Andrey Konovalov <andreyknvl@google.com>
+Date: Wed, 29 Mar 2017 16:11:20 +0200
+Subject: net/packet: fix overflow in check for priv area size
+
+From: Andrey Konovalov <andreyknvl@google.com>
+
+commit 2b6867c2ce76c596676bec7d2d525af525fdc6e2 upstream.
+
+Subtracting tp_sizeof_priv from tp_block_size and casting to int
+to check whether one is less then the other doesn't always work
+(both of them are unsigned ints).
+
+Compare them as is instead.
+
+Also cast tp_sizeof_priv to u64 before using BLK_PLUS_PRIV, as
+it can overflow inside BLK_PLUS_PRIV otherwise.
+
+Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/packet/af_packet.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4138,8 +4138,8 @@ static int packet_set_ring(struct sock *
+ 		if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
+ 			goto out;
+ 		if (po->tp_version >= TPACKET_V3 &&
+-		    (int)(req->tp_block_size -
+-			  BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0)
++		    req->tp_block_size <=
++			  BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
+ 			goto out;
+ 		if (unlikely(req->tp_frame_size < po->tp_hdrlen +
+ 					po->tp_reserve))
diff --git a/queue-4.4/series b/queue-4.4/series
index e4301aa47e4..e61bafc1a08 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -9,3 +9,4 @@ mips-switch-to-the-irq_stack-in-interrupts.patch
 mips-select-have_irq_exit_on_irq_stack.patch
 mips-irq-stack-fix-erroneous-jal-to-plat_irq_dispatch.patch
 crypto-caam-fix-rng-deinstantiation-error-checking.patch
+net-packet-fix-overflow-in-check-for-priv-area-size.patch