From b37d41a06d13728c78c5a6cc8a31412fcff376cb Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 27 Aug 2021 12:12:02 +0200 Subject: [PATCH] 5.4-stable patches added patches: net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch --- ...other-oob-read-in-qrtr_endpoint_post.patch | 47 +++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 queue-5.4/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch diff --git a/queue-5.4/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch b/queue-5.4/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch new file mode 100644 index 00000000000..4d77545c6be --- /dev/null +++ b/queue-5.4/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch @@ -0,0 +1,47 @@ +From 7e78c597c3ebfd0cb329aa09a838734147e4f117 Mon Sep 17 00:00:00 2001 +From: Xiaolong Huang +Date: Fri, 20 Aug 2021 03:50:34 +0800 +Subject: net: qrtr: fix another OOB Read in qrtr_endpoint_post + +From: Xiaolong Huang + +commit 7e78c597c3ebfd0cb329aa09a838734147e4f117 upstream. + +This check was incomplete, did not consider size is 0: + + if (len != ALIGN(size, 4) + hdrlen) + goto err; + +if size from qrtr_hdr is 0, the result of ALIGN(size, 4) +will be 0, In case of len == hdrlen and size == 0 +in header this check won't fail and + + if (cb->type == QRTR_TYPE_NEW_SERVER) { + /* Remote node endpoint can bridge other distant nodes */ + const struct qrtr_ctrl_pkt *pkt = data + hdrlen; + + qrtr_node_assign(node, le32_to_cpu(pkt->server.node)); + } + +will also read out of bound from data, which is hdrlen allocated block. + +Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets") +Fixes: ad9d24c9429e ("net: qrtr: fix OOB Read in qrtr_endpoint_post") +Signed-off-by: Xiaolong Huang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/qrtr/qrtr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -314,7 +314,7 @@ int qrtr_endpoint_post(struct qrtr_endpo + goto err; + } + +- if (len != ALIGN(size, 4) + hdrlen) ++ if (!size || len != ALIGN(size, 4) + hdrlen) + goto err; + + if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA) -- 2.47.3