From fe432e7c0118da96a1a61dadc0ff8769084adccd Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 14 Apr 2017 11:06:57 +0200 Subject: [PATCH] 3.18 patch --- ...overflow-in-check-for-priv-area-size.patch | 40 +++++++++++++++++++ queue-3.18/series | 1 + 2 files changed, 41 insertions(+) create mode 100644 queue-3.18/net-packet-fix-overflow-in-check-for-priv-area-size.patch diff --git a/queue-3.18/net-packet-fix-overflow-in-check-for-priv-area-size.patch b/queue-3.18/net-packet-fix-overflow-in-check-for-priv-area-size.patch new file mode 100644 index 00000000000..02b1a606d92 --- /dev/null +++ b/queue-3.18/net-packet-fix-overflow-in-check-for-priv-area-size.patch @@ -0,0 +1,40 @@ +From 2b6867c2ce76c596676bec7d2d525af525fdc6e2 Mon Sep 17 00:00:00 2001 +From: Andrey Konovalov +Date: Wed, 29 Mar 2017 16:11:20 +0200 +Subject: net/packet: fix overflow in check for priv area size + +From: Andrey Konovalov + +commit 2b6867c2ce76c596676bec7d2d525af525fdc6e2 upstream. + +Subtracting tp_sizeof_priv from tp_block_size and casting to int +to check whether one is less then the other doesn't always work +(both of them are unsigned ints). + +Compare them as is instead. + +Also cast tp_sizeof_priv to u64 before using BLK_PLUS_PRIV, as +it can overflow inside BLK_PLUS_PRIV otherwise. + +Signed-off-by: Andrey Konovalov +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/packet/af_packet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3808,8 +3808,8 @@ static int packet_set_ring(struct sock * + if (unlikely(req->tp_block_size & (PAGE_SIZE - 1))) + goto out; + if (po->tp_version >= TPACKET_V3 && +- (int)(req->tp_block_size - +- BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0) ++ req->tp_block_size <= ++ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv)) + goto out; + if (unlikely(req->tp_frame_size < po->tp_hdrlen + + po->tp_reserve)) diff --git a/queue-3.18/series b/queue-3.18/series index 09bfe83dd12..14266e20100 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -107,3 +107,4 @@ ipv4-mask-tos-for-input-route.patch l2tp-avoid-use-after-free-caused-by-l2tp_ip_backlog_recv.patch net-don-t-call-strlen-on-the-user-buffer-in-packet_bind_spkt.patch dccp-unlock-sock-before-calling-sk_free.patch +net-packet-fix-overflow-in-check-for-priv-area-size.patch -- 2.47.3