From: Greg Kroah-Hartman Date: Fri, 27 Aug 2021 10:11:04 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.4.283~79 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8dc8252361eef3d29eaee6357ab01ffac9560ff9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch --- diff --git a/queue-4.14/series b/queue-4.14/series new file mode 100644 index 00000000000..e69de29bb2d diff --git a/queue-4.19/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch b/queue-4.19/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch new file mode 100644 index 00000000000..e193afdf6e7 --- /dev/null +++ b/queue-4.19/net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch @@ -0,0 +1,47 @@ +From 7e78c597c3ebfd0cb329aa09a838734147e4f117 Mon Sep 17 00:00:00 2001 +From: Xiaolong Huang +Date: Fri, 20 Aug 2021 03:50:34 +0800 +Subject: net: qrtr: fix another OOB Read in qrtr_endpoint_post + +From: Xiaolong Huang + +commit 7e78c597c3ebfd0cb329aa09a838734147e4f117 upstream. + +This check was incomplete, did not consider size is 0: + + if (len != ALIGN(size, 4) + hdrlen) + goto err; + +if size from qrtr_hdr is 0, the result of ALIGN(size, 4) +will be 0, In case of len == hdrlen and size == 0 +in header this check won't fail and + + if (cb->type == QRTR_TYPE_NEW_SERVER) { + /* Remote node endpoint can bridge other distant nodes */ + const struct qrtr_ctrl_pkt *pkt = data + hdrlen; + + qrtr_node_assign(node, le32_to_cpu(pkt->server.node)); + } + +will also read out of bound from data, which is hdrlen allocated block. + +Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets") +Fixes: ad9d24c9429e ("net: qrtr: fix OOB Read in qrtr_endpoint_post") +Signed-off-by: Xiaolong Huang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/qrtr/qrtr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -321,7 +321,7 @@ int qrtr_endpoint_post(struct qrtr_endpo + goto err; + } + +- if (len != ALIGN(size, 4) + hdrlen) ++ if (!size || len != ALIGN(size, 4) + hdrlen) + goto err; + + if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA) diff --git a/queue-4.19/series b/queue-4.19/series new file mode 100644 index 00000000000..df41c568995 --- /dev/null +++ b/queue-4.19/series @@ -0,0 +1 @@ +net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch diff --git a/queue-4.9/series b/queue-4.9/series new file mode 100644 index 00000000000..e69de29bb2d diff --git a/queue-5.10/series b/queue-5.10/series new file mode 100644 index 00000000000..df41c568995 --- /dev/null +++ b/queue-5.10/series @@ -0,0 +1 @@ +net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch diff --git a/queue-5.13/series b/queue-5.13/series new file mode 100644 index 00000000000..df41c568995 --- /dev/null +++ b/queue-5.13/series @@ -0,0 +1 @@ +net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch diff --git a/queue-5.4/series b/queue-5.4/series new file mode 100644 index 00000000000..df41c568995 --- /dev/null +++ b/queue-5.4/series @@ -0,0 +1 @@ +net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch