update sources to Ubuntu-5.4.0-49.53
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
		
							parent
							
								
									ceee458b9c
								
							
						
					
					
						commit
						aca38cac89
					
				| @ -1,48 +0,0 @@ | |||||||
| From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |  | ||||||
| From: Or Cohen <orcohen@paloaltonetworks.com> |  | ||||||
| Date: Sun, 30 Aug 2020 20:04:51 +0300 |  | ||||||
| Subject: [PATCH] net/packet: fix overflow in tpacket_rcv |  | ||||||
| 
 |  | ||||||
| Using tp_reserve to calculate netoff can overflow as |  | ||||||
| tp_reserve is unsigned int and netoff is unsigned short. |  | ||||||
| 
 |  | ||||||
| This may lead to macoff receving a smaller value then |  | ||||||
| sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr |  | ||||||
| is set, an out-of-bounds write will occur when |  | ||||||
| calling virtio_net_hdr_from_skb. |  | ||||||
| 
 |  | ||||||
| The bug is fixed by converting netoff to unsigned int |  | ||||||
| and checking if it exceeds USHRT_MAX. |  | ||||||
| 
 |  | ||||||
| Fixes: 8913336a7e8d ("packet: add PACKET_RESERVE sockopt") |  | ||||||
| Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com> |  | ||||||
| Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com> |  | ||||||
| ---
 |  | ||||||
|  net/packet/af_packet.c | 7 ++++++- |  | ||||||
|  1 file changed, 6 insertions(+), 1 deletion(-) |  | ||||||
| 
 |  | ||||||
| diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
 |  | ||||||
| index 7735340c892e..fbc2d4dfddf0 100644
 |  | ||||||
| --- a/net/packet/af_packet.c
 |  | ||||||
| +++ b/net/packet/af_packet.c
 |  | ||||||
| @@ -2169,7 +2169,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
 |  | ||||||
|  	int skb_len = skb->len; |  | ||||||
|  	unsigned int snaplen, res; |  | ||||||
|  	unsigned long status = TP_STATUS_USER; |  | ||||||
| -	unsigned short macoff, netoff, hdrlen;
 |  | ||||||
| +	unsigned short macoff, hdrlen;
 |  | ||||||
| +	unsigned int netoff;
 |  | ||||||
|  	struct sk_buff *copy_skb = NULL; |  | ||||||
|  	struct timespec ts; |  | ||||||
|  	__u32 ts_status; |  | ||||||
| @@ -2238,6 +2239,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
 |  | ||||||
|  		} |  | ||||||
|  		macoff = netoff - maclen; |  | ||||||
|  	} |  | ||||||
| +	if (netoff > USHRT_MAX) {
 |  | ||||||
| +		atomic_inc(&po->tp_drops);
 |  | ||||||
| +		goto drop_n_restore;
 |  | ||||||
| +	}
 |  | ||||||
|  	if (po->tp_version <= TPACKET_V2) { |  | ||||||
|  		if (macoff + snaplen > po->rx_ring.frame_size) { |  | ||||||
|  			if (po->copy_thresh && |  | ||||||
| @ -1 +1 @@ | |||||||
| Subproject commit dd82b8d705861502afb7de0210e694ff1769a89a | Subproject commit fd386a64a1ed3f2f047318508ebd733f56a4fab2 | ||||||
		Loading…
	
		Reference in New Issue
	
	Block a user
	 Thomas Lamprecht
						Thomas Lamprecht