linux-cavium: CVE-2017-7487

call ipxitf_put() in ioctl error path

References:
https://nvd.nist.gov/vuln/detail/CVE-2017-7487

Upstream patch
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=v4.9.50&id=820adccd0e3be9bdd2384ca8fc4712108cfdf28b

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Martin Borg <martin.borg@enea.com>

2 files changed, 40 insertions, 0 deletions

diff --git a/recipes-kernel/linux/linux-cavium/CVE-2017-7487.patch b/recipes-kernel/linux/linux-cavium/CVE-2017-7487.patch
new file mode 100644
index 0000000..41849fe
--- /dev/null
+++ b/recipes-kernel/linux/linux-cavium/CVE-2017-7487.patch
@@ -0,0 +1,39 @@
+From ee0d8d8482345ff97a75a7d747efc309f13b0d80 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 2 May 2017 13:58:53 +0300
+Subject: [PATCH] ipx: call ipxitf_put() in ioctl error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We should call ipxitf_put() if the copy_to_user() fails.
+
+CVE: CVE-2017-7487
+Upstream-Status: Backport [backport from: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=v4.9.50&id=820adccd0e3be9bdd2384ca8fc4712108cfdf28b]
+
+Reported-by: 李强 <liqiang6-s@360.cn>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ net/ipx/af_ipx.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
+index 8a9219ff2e77e..fa31ef29e3fa0 100644
+--- a/net/ipx/af_ipx.c
++++ b/net/ipx/af_ipx.c
+@@ -1168,11 +1168,10 @@ static int ipxitf_ioctl(unsigned int cmd, void __user *arg)
+                sipx->sipx_network      = ipxif->if_netnum;
+                memcpy(sipx->sipx_node, ipxif->if_node,
+                        sizeof(sipx->sipx_node));
+-               rc = -EFAULT;
++               rc = 0;
+                if (copy_to_user(arg, &ifr, sizeof(ifr)))
+-                       break;
++                       rc = -EFAULT;
+                ipxitf_put(ipxif);
+-               rc = 0;
+                break;
+        }
+        case SIOCAIPXITFCRT:
diff --git a/recipes-kernel/linux/linux-cavium_4.9.inc b/recipes-kernel/linux/linux-cavium_4.9.inc
index feb37da..3a4eeb5 100644
--- a/recipes-kernel/linux/linux-cavium_4.9.inc
+++ b/recipes-kernel/linux/linux-cavium_4.9.inc
@@ -15,6 +15,7 @@ KENEABRANCH = "cavium-4.9"
 SRC_URI = "git://git@git.enea.com/linux/linux-cavium.git;protocol=ssh;name=machine;branch=${KBRANCH} \
            git://git@git.enea.com/linux/enea-kernel-cache.git;protocol=ssh;type=kmeta;name=metaenea;branch=${KENEABRANCH};destsuffix=enea-kernel-cache \
            file://dts \
+           file://CVE-2017-7487.patch \
            "
 
 LINUX_KERNEL_TYPE = "tiny"