udp: CVE-2016-10229

udp: properly support MSG_PEEK with truncated buffers

References:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.1.y&id=5c564705d3f0436ddc70d833b975b870ba560528

Change-Id: Ib677b5853b2ce51ed3a976ddbfb7cf1806badd2e
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

2 files changed, 104 insertions, 0 deletions

diff --git a/patches/cve/4.1.x.scc b/patches/cve/4.1.x.scc
index 4451d85..96110a0 100644
--- a/patches/cve/4.1.x.scc
+++ b/patches/cve/4.1.x.scc
@@ -2,3 +2,6 @@
 patch CVE-2016-7039-net-add-recursion-limit-to-GRO.patch
 patch CVE-2016-8399-net-ping-check-minimum-size-on-ICMP-header-length.patch
 patch CVE-2016-8655-packet-fix-race-condition-in-packet_set_ring.patch
+
+#fixed in 4.1.40
+patch CVE-2016-10229-udp-properly-support-MSG_PEEK-with-truncated-buffers.patch
diff --git a/patches/cve/CVE-2016-10229-udp-properly-support-MSG_PEEK-with-truncated-buffers.patch b/patches/cve/CVE-2016-10229-udp-properly-support-MSG_PEEK-with-truncated-buffers.patch
new file mode 100644
index 0000000..3ddb434
--- /dev/null
+++ b/patches/cve/CVE-2016-10229-udp-properly-support-MSG_PEEK-with-truncated-buffers.patch
@@ -0,0 +1,101 @@
+From 5c564705d3f0436ddc70d833b975b870ba560528 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 30 Dec 2015 08:51:12 -0500
+Subject: [PATCH] udp: properly support MSG_PEEK with truncated buffers
+
+[ Upstream commit 197c949e7798fbf28cfadc69d9ca0c2abbf93191 ]
+
+Backport of this upstream commit into stable kernels :
+89c22d8c3b27 ("net: Fix skb csum races when peeking")
+exposed a bug in udp stack vs MSG_PEEK support, when user provides
+a buffer smaller than skb payload.
+
+In this case,
+skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr),
+                                 msg->msg_iov);
+returns -EFAULT.
+
+This bug does not happen in upstream kernels since Al Viro did a great
+job to replace this into :
+skb_copy_and_csum_datagram_msg(skb, sizeof(struct udphdr), msg);
+This variant is safe vs short buffers.
+
+For the time being, instead reverting Herbert Xu patch and add back
+skb->ip_summed invalid changes, simply store the result of
+udp_lib_checksum_complete() so that we avoid computing the checksum a
+second time, and avoid the problematic
+skb_copy_and_csum_datagram_iovec() call.
+
+This patch can be applied on recent kernels as it avoids a double
+checksumming, then backported to stable kernels as a bug fix.
+
+CVE: CVE-2016-10229   
+Upstream-Status: Backport  
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ net/ipv4/udp.c | 6 ++++--
+ net/ipv6/udp.c | 6 ++++--
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 031752e..4567189 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1264,6 +1264,7 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
+        int peeked, off = 0;
+        int err;
+        int is_udplite = IS_UDPLITE(sk);
++       bool checksum_valid = false;
+        bool slow;
+ 
+        if (flags & MSG_ERRQUEUE)
+@@ -1289,11 +1290,12 @@ try_again:
+         */
+ 
+        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+-               if (udp_lib_checksum_complete(skb))
++               checksum_valid = !udp_lib_checksum_complete(skb);
++               if (!checksum_valid)
+                        goto csum_copy_err;
+        }
+ 
+-       if (skb_csum_unnecessary(skb))
++       if (checksum_valid || skb_csum_unnecessary(skb))
+                err = skb_copy_datagram_msg(skb, sizeof(struct udphdr),
+                                            msg, copied);
+        else {
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 1173557..7aa424c 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -399,6 +399,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+        int peeked, off = 0;
+        int err;
+        int is_udplite = IS_UDPLITE(sk);
++       bool checksum_valid = false;
+        int is_udp4;
+        bool slow;
+ 
+@@ -430,11 +431,12 @@ try_again:
+         */
+ 
+        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+-               if (udp_lib_checksum_complete(skb))
++               checksum_valid = !udp_lib_checksum_complete(skb);
++               if (!checksum_valid)
+                        goto csum_copy_err;
+        }
+ 
+-       if (skb_csum_unnecessary(skb))
++       if (checksum_valid || skb_csum_unnecessary(skb))
+                err = skb_copy_datagram_msg(skb, sizeof(struct udphdr),
+                                            msg, copied);
+        else {
+-- 
+
+