diff --git a/patches/kernel/0007-net-packet-fix-overflow-in-tpacket_rcv.patch b/patches/kernel/0007-net-packet-fix-overflow-in-tpacket_rcv.patch deleted file mode 100644 index 794da19..0000000 --- a/patches/kernel/0007-net-packet-fix-overflow-in-tpacket_rcv.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Or Cohen -Date: Sun, 30 Aug 2020 20:04:51 +0300 -Subject: [PATCH] net/packet: fix overflow in tpacket_rcv - -Using tp_reserve to calculate netoff can overflow as -tp_reserve is unsigned int and netoff is unsigned short. - -This may lead to macoff receving a smaller value then -sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr -is set, an out-of-bounds write will occur when -calling virtio_net_hdr_from_skb. - -The bug is fixed by converting netoff to unsigned int -and checking if it exceeds USHRT_MAX. - -Fixes: 8913336a7e8d ("packet: add PACKET_RESERVE sockopt") -Signed-off-by: Or Cohen -Signed-off-by: Thomas Lamprecht ---- - net/packet/af_packet.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 7735340c892e..fbc2d4dfddf0 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2169,7 +2169,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - int skb_len = skb->len; - unsigned int snaplen, res; - unsigned long status = TP_STATUS_USER; -- unsigned short macoff, netoff, hdrlen; -+ unsigned short macoff, hdrlen; -+ unsigned int netoff; - struct sk_buff *copy_skb = NULL; - struct timespec ts; - __u32 ts_status; -@@ -2238,6 +2239,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - } - macoff = netoff - maclen; - } -+ if (netoff > USHRT_MAX) { -+ atomic_inc(&po->tp_drops); -+ goto drop_n_restore; -+ } - if (po->tp_version <= TPACKET_V2) { - if (macoff + snaplen > po->rx_ring.frame_size) { - if (po->copy_thresh && diff --git a/submodules/ubuntu-focal b/submodules/ubuntu-focal index dd82b8d..fd386a6 160000 --- a/submodules/ubuntu-focal +++ b/submodules/ubuntu-focal @@ -1 +1 @@ -Subproject commit dd82b8d705861502afb7de0210e694ff1769a89a +Subproject commit fd386a64a1ed3f2f047318508ebd733f56a4fab2