From: Arne Fitzenreiter Date: Fri, 11 Sep 2020 20:16:27 +0000 (+0200) Subject: Revert "kernel: add patch against CVE-2020-14386" X-Git-Url: http://git.ipfire.org/?p=people%2Fpmueller%2Fipfire-2.x.git;a=commitdiff_plain;h=9dafa28a1c2df8335de30db300e2ca4093e57ccd Revert "kernel: add patch against CVE-2020-14386" This reverts commit f04023b1ca5675ce5463ca47186462179fd7a02a. Signed-off-by: Arne Fitzenreiter --- diff --git a/lfs/linux b/lfs/linux index 57f355e742..8bec961509 100644 --- a/lfs/linux +++ b/lfs/linux @@ -144,9 +144,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-random_try_to_actively_add_entropy.patch cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-4.14.x-add_timer_setup_on_stack.patch - # Patch CVE-2020-14386 - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch - ifeq "$(KCFG)" "-multi" # Apply Arm-multiarch kernel patches. cd $(DIR_APP) && xzcat $(DIR_DL)/arm-multi-patches-$(ARM_PATCHES).patch.xz | patch -Np1 diff --git a/src/patches/linux/linux-cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch b/src/patches/linux/linux-cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch deleted file mode 100644 index 439dca7ac9..0000000000 --- a/src/patches/linux/linux-cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch +++ /dev/null @@ -1,54 +0,0 @@ -From acf69c946233259ab4d64f8869d4037a198c7f06 Mon Sep 17 00:00:00 2001 -From: Or Cohen -Date: Thu, 3 Sep 2020 21:05:28 -0700 -Subject: net/packet: fix overflow in tpacket_rcv - -Using tp_reserve to calculate netoff can overflow as -tp_reserve is unsigned int and netoff is unsigned short. - -This may lead to macoff receving a smaller value then -sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr -is set, an out-of-bounds write will occur when -calling virtio_net_hdr_from_skb. - -The bug is fixed by converting netoff to unsigned int -and checking if it exceeds USHRT_MAX. - -This addresses CVE-2020-14386 - -Fixes: 8913336a7e8d ("packet: add PACKET_RESERVE sockopt") -Signed-off-by: Or Cohen -Signed-off-by: Eric Dumazet -Signed-off-by: Linus Torvalds ---- - net/packet/af_packet.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index da8254e680f94..2b33e977a9059 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2170,7 +2170,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - int skb_len = skb->len; - unsigned int snaplen, res; - unsigned long status = TP_STATUS_USER; -- unsigned short macoff, netoff, hdrlen; -+ unsigned short macoff, hdrlen; -+ unsigned int netoff; - struct sk_buff *copy_skb = NULL; - struct timespec64 ts; - __u32 ts_status; -@@ -2239,6 +2240,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - } - macoff = netoff - maclen; - } -+ if (netoff > USHRT_MAX) { -+ atomic_inc(&po->tp_drops); -+ goto drop_n_restore; -+ } - if (po->tp_version <= TPACKET_V2) { - if (macoff + snaplen > po->rx_ring.frame_size) { - if (po->copy_thresh && --- -cgit 1.2.3-1.el7 -