From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 14 Apr 2017 09:07:11 +0000 (+0200)
Subject: 4.10-stable patches
X-Git-Tag: v4.10.11~11
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fe4d8a9db44c206ca1c1e85f688e547de1b4412d;p=thirdparty%2Fkernel%2Fstable-queue.git

4.10-stable patches

added patches:
	net-packet-fix-overflow-in-check-for-priv-area-size.patch
---

diff --git a/queue-4.10/net-packet-fix-overflow-in-check-for-priv-area-size.patch b/queue-4.10/net-packet-fix-overflow-in-check-for-priv-area-size.patch
new file mode 100644
index 00000000000..5de35c61871
--- /dev/null
+++ b/queue-4.10/net-packet-fix-overflow-in-check-for-priv-area-size.patch
@@ -0,0 +1,40 @@
+From 2b6867c2ce76c596676bec7d2d525af525fdc6e2 Mon Sep 17 00:00:00 2001
+From: Andrey Konovalov <andreyknvl@google.com>
+Date: Wed, 29 Mar 2017 16:11:20 +0200
+Subject: net/packet: fix overflow in check for priv area size
+
+From: Andrey Konovalov <andreyknvl@google.com>
+
+commit 2b6867c2ce76c596676bec7d2d525af525fdc6e2 upstream.
+
+Subtracting tp_sizeof_priv from tp_block_size and casting to int
+to check whether one is less then the other doesn't always work
+(both of them are unsigned ints).
+
+Compare them as is instead.
+
+Also cast tp_sizeof_priv to u64 before using BLK_PLUS_PRIV, as
+it can overflow inside BLK_PLUS_PRIV otherwise.
+
+Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/packet/af_packet.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4177,8 +4177,8 @@ static int packet_set_ring(struct sock *
+ 		if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
+ 			goto out;
+ 		if (po->tp_version >= TPACKET_V3 &&
+-		    (int)(req->tp_block_size -
+-			  BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0)
++		    req->tp_block_size <=
++			  BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
+ 			goto out;
+ 		if (unlikely(req->tp_frame_size < po->tp_hdrlen +
+ 					po->tp_reserve))
diff --git a/queue-4.10/series b/queue-4.10/series
index e51d6c0af29..44028e9cd7e 100644
--- a/queue-4.10/series
+++ b/queue-4.10/series
@@ -25,3 +25,4 @@ mips-select-have_irq_exit_on_irq_stack.patch
 mips-irq-stack-fix-erroneous-jal-to-plat_irq_dispatch.patch
 crypto-caam-fix-rng-deinstantiation-error-checking.patch
 crypto-caam-fix-invalid-dereference-in-caam_rsa_init_tfm.patch
+net-packet-fix-overflow-in-check-for-priv-area-size.patch