Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity
android_kernel_samsung_msm8976/net
History
Or Cohen 97d7817dce net/packet: fix overflow in tpacket_rcv 
commit acf69c946233259ab4d64f8869d4037a198c7f06 upstream.

Using tp_reserve to calculate netoff can overflow as
tp_reserve is unsigned int and netoff is unsigned short.

This may lead to macoff receving a smaller value then
sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr
is set, an out-of-bounds write will occur when
calling virtio_net_hdr_from_skb.

The bug is fixed by converting netoff to unsigned int
and checking if it exceeds USHRT_MAX.

This addresses CVE-2020-14386

Fixes: 8913336a7e ("packet: add PACKET_RESERVE sockopt")
Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[ snu: backported to pre-5.3, changed tp_drops counting/locking ]
Signed-off-by: Stefan Nuernberger <snu@amazon.com>
CC: David Woodhouse <dwmw@amazon.co.uk>
CC: Amit Shah <aams@amazon.com>
CC: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Change-Id: Id70a19d5550c27f8527f95b2a838d53e3bb73ffb
 		2020-10-12 19:27:28 +02:00
..
9p
…
802
…
8021q
…
appletalk net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
atm
…
ax25 net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
batman-adv
…
bluetooth Bluetooth: Check state in l2cap_disconnect_rsp 2019-08-05 03:10:33 +02:00
bridge net: bridge: multicast: use rcu to access port list from br_multicast_start_querier 2019-08-15 21:02:28 +02:00
caif
…
can net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
ceph libceph: introduce ceph_crypt() for in-place en/decryption 2017-04-22 23:02:50 +02:00
core net: sockev: avoid races between sockev and socket_close 2020-10-11 20:40:04 +02:00
dcb
…
dccp net/dccp: fix use after free in tw_timer_handler() 2019-07-27 22:08:37 +02:00
decnet net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
dns_resolver dns_resolver: Do not accept domain names longer than 255 chars 2019-07-27 22:07:53 +02:00
dsa
…
ethernet
…
ieee802154 net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
ipc_router net: ipc_router: Do not allow change of default security rule 2020-06-06 20:31:07 +02:00
ipv4 igmp: fix memory leak in igmpv3_del_delrec() 2019-10-27 19:33:52 +01:00
ipv6 igmp, mld: Fix memory leak in igmpv3/mld_del_delrec() 2019-10-27 19:33:52 +01:00
ipx net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
irda net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
iucv
…
key af_key: fix leaks in key_pol_get_resp and dump_sp. 2019-10-27 19:33:52 +01:00
l2tp net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
lapb
…
llc net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
mac80211 mac80211: use constant time comparison with keys 2019-07-27 21:45:47 +02:00
mac802154
…
netfilter ANDROID: fix a bug in quota2 2020-08-24 20:37:32 +02:00
netlabel netlabel: check for IPV4MASK in addrinfo_get 2019-09-28 20:28:33 +02:00
netlink net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
netrom net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
nfc net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
openvswitch
…
packet net/packet: fix overflow in tpacket_rcv 2020-10-12 19:27:28 +02:00
phonet net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
rds net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
rfkill net: rfkill: move poll work to power efficient workqueue 2019-07-27 22:11:06 +02:00
rmnet_data net: rmnet_data: Change the log level for unknown IOCTL's 2019-07-27 21:51:01 +02:00
rose net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
rxrpc net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
sched net: Prevent invalid access to skb->prev in __qdisc_drop_all 2019-07-27 21:53:24 +02:00
sctp sctp: fix a type cast warnings that causes a_rwnd gets the wrong value 2019-07-27 21:45:39 +02:00
sunrpc kernel: make groups_sort calling a responsibility group_info allocators 2019-07-27 21:46:18 +02:00
tipc net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
unix net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
vmw_vsock net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
wimax
…
wireless msm: wlan: Modify JP regulatory rules 2020-03-20 22:08:35 +01:00
x25 net: add build-time checks for msg->msg_name size 2019-08-16 03:55:59 +02:00
xfrm xfrm: validate template mode 2019-09-28 20:28:33 +02:00
Kconfig
…
Makefile
…
activity_stats.c
…
compat.c net: support compat 64-bit time in {s,g}etsockopt 2019-07-27 21:49:09 +02:00
nonet.c
…
socket.c kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user() 2019-07-27 22:10:26 +02:00
sysctl_net.c
…