From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 28 Aug 2018 13:01:16 +0000 (+0200)
Subject: 4.4-stable patches
X-Git-Tag: v3.18.121~59
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fc75bdd86df240b3e66176f7c9456cbbf71260a6;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	cipso-cipso_v4_optptr-enter-infinite-loop.patch
---

diff --git a/queue-4.4/cipso-cipso_v4_optptr-enter-infinite-loop.patch b/queue-4.4/cipso-cipso_v4_optptr-enter-infinite-loop.patch
new file mode 100644
index 00000000000..bccf202a1e8
--- /dev/null
+++ b/queue-4.4/cipso-cipso_v4_optptr-enter-infinite-loop.patch
@@ -0,0 +1,44 @@
+From 40413955ee265a5e42f710940ec78f5450d49149 Mon Sep 17 00:00:00 2001
+From: "yujuan.qi" <yujuan.qi@mediatek.com>
+Date: Mon, 31 Jul 2017 11:23:01 +0800
+Subject: Cipso: cipso_v4_optptr enter infinite loop
+
+From: yujuan.qi <yujuan.qi@mediatek.com>
+
+commit 40413955ee265a5e42f710940ec78f5450d49149 upstream.
+
+in for(),if((optlen > 0) && (optptr[1] == 0)), enter infinite loop.
+
+Test: receive a packet which the ip length > 20 and the first byte of ip option is 0, produce this issue
+
+Signed-off-by: yujuan.qi <yujuan.qi@mediatek.com>
+Acked-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/cipso_ipv4.c |   12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -1593,9 +1593,17 @@ unsigned char *cipso_v4_optptr(const str
+ 	int taglen;
+ 
+ 	for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
+-		if (optptr[0] == IPOPT_CIPSO)
++		switch (optptr[0]) {
++		case IPOPT_CIPSO:
+ 			return optptr;
+-		taglen = optptr[1];
++		case IPOPT_END:
++			return NULL;
++		case IPOPT_NOOP:
++			taglen = 1;
++			break;
++		default:
++			taglen = optptr[1];
++		}
+ 		optlen -= taglen;
+ 		optptr += taglen;
+ 	}
diff --git a/queue-4.4/series b/queue-4.4/series
index 3af795e857c..58ce1ac0ce8 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -1 +1,2 @@
 sched-sysctl-check-user-input-value-of-sysctl_sched_time_avg.patch
+cipso-cipso_v4_optptr-enter-infinite-loop.patch