linux-cavium: CVE-2017-6214

ipv4/tcp: Infinite loop in tcp_splice_read()

Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-6214

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Martin Borg <martin.borg@enea.com>

2 files changed, 53 insertions, 0 deletions

diff --git a/recipes-kernel/linux/linux-cavium/CVE-2017-6214.patch b/recipes-kernel/linux/linux-cavium/CVE-2017-6214.patch
new file mode 100644
index 0000000..640ed5c
--- /dev/null
+++ b/recipes-kernel/linux/linux-cavium/CVE-2017-6214.patch
@@ -0,0 +1,52 @@
+From 0f895f51a831d73ce24158534784aba5b2a72a9e Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Fri, 3 Feb 2017 14:59:38 -0800
+Subject: [PATCH] tcp: avoid infinite loop in tcp_splice_read()
+
+[ Upstream commit ccf7abb93af09ad0868ae9033d1ca8108bdaec82 ]
+
+Splicing from TCP socket is vulnerable when a packet with URG flag is
+received and stored into receive queue.
+
+__tcp_splice_read() returns 0, and sk_wait_data() immediately
+returns since there is the problematic skb in queue.
+
+This is a nice way to burn cpu (aka infinite loop) and trigger
+soft lockups.
+
+Again, this gem was found by syzkaller tool.
+
+CVE: CVE-2017-6214
+Upstream-Status: Backport [from kernel.org longterm 4.9.52]
+
+Fixes: 9c55e01c0cc8 ("[TCP]: Splice receive support.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Dmitry Vyukov  <dvyukov@google.com>
+Cc: Willy Tarreau <w@1wt.eu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ net/ipv4/tcp.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 814af89..6a90a0e 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -772,6 +772,12 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
+                                ret = -EAGAIN;
+                                break;
+                        }
++                       /* if __tcp_splice_read() got nothing while we have
++                        * an skb in receive queue, we do not want to loop.
++                        * This might happen with URG data.
++                        */
++                       if (!skb_queue_empty(&sk->sk_receive_queue))
++                               break;
+                        sk_wait_data(sk, &timeo, NULL);
+                        if (signal_pending(current)) {
+                                ret = sock_intr_errno(timeo);
+-- 
+1.9.1
+
diff --git a/recipes-kernel/linux/linux-cavium_4.9.inc b/recipes-kernel/linux/linux-cavium_4.9.inc
index 6aa43f4..67488ba 100644
--- a/recipes-kernel/linux/linux-cavium_4.9.inc
+++ b/recipes-kernel/linux/linux-cavium_4.9.inc
@@ -22,6 +22,7 @@ SRC_URI = "git://git@git.enea.com/linux/linux-cavium.git;protocol=ssh;name=machi
            file://CVE-2017-5669.patch \
            file://CVE-2017-5970.patch \
            file://CVE-2017-5986.patch \
+           file://CVE-2017-6214.patch \
            file://CVE-2017-7487.patch \
            file://CVE-2017-7618.patch \
            file://CVE-2017-7645.patch \