From 82822b1cc96cadc4a593f2e9e11b4e9194429bcb Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 5 Oct 2020 15:43:52 +0200 Subject: [PATCH] 4.9-stable patches added patches: net-packet-fix-overflow-in-tpacket_rcv.patch --- ...t-packet-fix-overflow-in-tpacket_rcv.patch | 61 +++++++++++++++++++ queue-4.9/series | 1 + 2 files changed, 62 insertions(+) create mode 100644 queue-4.9/net-packet-fix-overflow-in-tpacket_rcv.patch diff --git a/queue-4.9/net-packet-fix-overflow-in-tpacket_rcv.patch b/queue-4.9/net-packet-fix-overflow-in-tpacket_rcv.patch new file mode 100644 index 00000000000..6f504fe2370 --- /dev/null +++ b/queue-4.9/net-packet-fix-overflow-in-tpacket_rcv.patch @@ -0,0 +1,61 @@ +From acf69c946233259ab4d64f8869d4037a198c7f06 Mon Sep 17 00:00:00 2001 +From: Or Cohen +Date: Thu, 3 Sep 2020 21:05:28 -0700 +Subject: net/packet: fix overflow in tpacket_rcv + +From: Or Cohen + +commit acf69c946233259ab4d64f8869d4037a198c7f06 upstream. + +Using tp_reserve to calculate netoff can overflow as +tp_reserve is unsigned int and netoff is unsigned short. + +This may lead to macoff receving a smaller value then +sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr +is set, an out-of-bounds write will occur when +calling virtio_net_hdr_from_skb. + +The bug is fixed by converting netoff to unsigned int +and checking if it exceeds USHRT_MAX. + +This addresses CVE-2020-14386 + +Fixes: 8913336a7e8d ("packet: add PACKET_RESERVE sockopt") +Signed-off-by: Or Cohen +Signed-off-by: Eric Dumazet +Signed-off-by: Linus Torvalds +[ snu: backported to pre-5.3, changed tp_drops counting/locking ] +Signed-off-by: Stefan Nuernberger +CC: David Woodhouse +CC: Amit Shah +CC: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + net/packet/af_packet.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2161,7 +2161,8 @@ static int tpacket_rcv(struct sk_buff *s + int skb_len = skb->len; + unsigned int snaplen, res; + unsigned long status = TP_STATUS_USER; +- unsigned short macoff, netoff, hdrlen; ++ unsigned short macoff, hdrlen; ++ unsigned int netoff; + struct sk_buff *copy_skb = NULL; + struct timespec ts; + __u32 ts_status; +@@ -2223,6 +2224,12 @@ static int tpacket_rcv(struct sk_buff *s + } + macoff = netoff - maclen; + } ++ if (netoff > USHRT_MAX) { ++ spin_lock(&sk->sk_receive_queue.lock); ++ po->stats.stats1.tp_drops++; ++ spin_unlock(&sk->sk_receive_queue.lock); ++ goto drop_n_restore; ++ } + if (po->tp_version <= TPACKET_V2) { + if (macoff + snaplen > po->rx_ring.frame_size) { + if (po->copy_thresh && diff --git a/queue-4.9/series b/queue-4.9/series index c9107ed88d7..576a1b73f7f 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -14,3 +14,4 @@ clk-samsung-exynos4-mark-chipid-clock-as-clk_ignore_.patch iommu-exynos-add-missing-put_device-call-in-exynos_i.patch i2c-cpm-fix-i2c_ram-structure.patch random32-restore-__latent_entropy-attribute-on-net_r.patch +net-packet-fix-overflow-in-tpacket_rcv.patch -- 2.47.3