net/packet: CVE-2017-7308

net/packet: fix overflow in check for priv area size

References:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.1.y&id=dd07486ceba48b5d2157b212bb9bd5ce9a46b593

Change-Id: I21713abf14677f885f66c627fa0e83dbde286237
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

2 files changed, 45 insertions, 0 deletions

diff --git a/patches/cve/4.1.x.scc b/patches/cve/4.1.x.scc
index 2f3ae79..17685e1 100644
--- a/patches/cve/4.1.x.scc
+++ b/patches/cve/4.1.x.scc
@@ -11,3 +11,4 @@ patch CVE-2017-7895-nfsd-stricter-decoding-of-write-like-NFSv2-v3-ops.patch
 #fixed in 4.1.41
 patch CVE-2017-10661-timerfd-Protect-the-might-cancel-mechanism-proper.patch
 patch CVE-2017-18221-mlock-fix-mlock-count-can-not-decrease-in-race-condi.patch
+patch CVE-2017-7308-net-packet-fix-overflow-in-check-for-priv-area-size.patch
diff --git a/patches/cve/CVE-2017-7308-net-packet-fix-overflow-in-check-for-priv-area-size.patch b/patches/cve/CVE-2017-7308-net-packet-fix-overflow-in-check-for-priv-area-size.patch
new file mode 100644
index 0000000..fbad094
--- /dev/null
+++ b/patches/cve/CVE-2017-7308-net-packet-fix-overflow-in-check-for-priv-area-size.patch
@@ -0,0 +1,44 @@
+From dd07486ceba48b5d2157b212bb9bd5ce9a46b593 Mon Sep 17 00:00:00 2001
+From: Andrey Konovalov <andreyknvl@google.com>
+Date: Wed, 29 Mar 2017 16:11:20 +0200
+Subject: [PATCH] net/packet: fix overflow in check for priv area size
+
+[ Upstream commit 2b6867c2ce76c596676bec7d2d525af525fdc6e2 ]
+
+Subtracting tp_sizeof_priv from tp_block_size and casting to int
+to check whether one is less then the other doesn't always work
+(both of them are unsigned ints).
+
+Compare them as is instead.
+
+Also cast tp_sizeof_priv to u64 before using BLK_PLUS_PRIV, as
+it can overflow inside BLK_PLUS_PRIV otherwise.
+
+CVE: CVE-2017-7308 
+Upstream-Status: Backport  
+
+Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ net/packet/af_packet.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index b9d1baa..83c05aa 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3867,8 +3867,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+                if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
+                        goto out;
+                if (po->tp_version >= TPACKET_V3 &&
+-                   (int)(req->tp_block_size -
+-                         BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0)
++                   req->tp_block_size <=
++                         BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
+                        goto out;
+                if (unlikely(req->tp_frame_size < po->tp_hdrlen +
+                                        po->tp_reserve))
+--