linux-cavium: CVE-2017-8069

rtl8150.c interacts incorrectly with the CONFIG_VMAP_STACK option

Reference:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8069

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Martin Borg <martin.borg@enea.com>

2 files changed, 74 insertions, 0 deletions

diff --git a/recipes-kernel/linux/linux-cavium/CVE-2017-8069.patch b/recipes-kernel/linux/linux-cavium/CVE-2017-8069.patch
new file mode 100644
index 0000000..11a3ee2
--- /dev/null
+++ b/recipes-kernel/linux/linux-cavium/CVE-2017-8069.patch
@@ -0,0 +1,73 @@
+From e898f6f008aa91c154c9c8fb7be3fb9ec4d333ec Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Sat, 4 Feb 2017 16:56:32 +0000
+Subject: [PATCH] rtl8150: Use heap buffers for all register access
+
+[ Upstream commit 7926aff5c57b577ab0f43364ff0c59d968f6a414 ]
+
+Allocating USB buffers on the stack is not portable, and no longer
+works on x86_64 (with VMAP_STACK enabled as per default).
+
+CVE: CVE-2017-8069
+Upstream-Status: Backport [backport from: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=v4.9.51&id=e898f6f008aa91c154c9c8fb7be3fb9ec4d333ec]
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ drivers/net/usb/rtl8150.c | 34 +++++++++++++++++++++++++++-------
+ 1 file changed, 27 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index 7c72bfa..dc4f7ea 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -155,16 +155,36 @@ struct async_req {
+ */
+ static int get_registers(rtl8150_t * dev, u16 indx, u16 size, void *data)
+ {
+-       return usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
+-                              RTL8150_REQ_GET_REGS, RTL8150_REQT_READ,
+-                              indx, 0, data, size, 500);
++       void *buf;
++       int ret;
++
++       buf = kmalloc(size, GFP_NOIO);
++       if (!buf)
++               return -ENOMEM;
++
++       ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
++                             RTL8150_REQ_GET_REGS, RTL8150_REQT_READ,
++                             indx, 0, buf, size, 500);
++       if (ret > 0 && ret <= size)
++               memcpy(data, buf, ret);
++       kfree(buf);
++       return ret;
+ }
+ 
+-static int set_registers(rtl8150_t * dev, u16 indx, u16 size, void *data)
++static int set_registers(rtl8150_t * dev, u16 indx, u16 size, const void *data)
+ {
+-       return usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
+-                              RTL8150_REQ_SET_REGS, RTL8150_REQT_WRITE,
+-                              indx, 0, data, size, 500);
++       void *buf;
++       int ret;
++
++       buf = kmemdup(data, size, GFP_NOIO);
++       if (!buf)
++               return -ENOMEM;
++
++       ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
++                             RTL8150_REQ_SET_REGS, RTL8150_REQT_WRITE,
++                             indx, 0, buf, size, 500);
++       kfree(buf);
++       return ret;
+ }
+ 
+ static void async_set_reg_cb(struct urb *urb)
+-- 
+1.9.1
+
diff --git a/recipes-kernel/linux/linux-cavium_4.9.inc b/recipes-kernel/linux/linux-cavium_4.9.inc
index 9115ece..8b7fe31 100644
--- a/recipes-kernel/linux/linux-cavium_4.9.inc
+++ b/recipes-kernel/linux/linux-cavium_4.9.inc
@@ -22,6 +22,7 @@ SRC_URI = "git://git@git.enea.com/linux/linux-cavium.git;protocol=ssh;name=machi
            file://CVE-2017-8066.patch \
            file://CVE-2017-8067.patch \
            file://CVE-2017-8068.patch \
+           file://CVE-2017-8069.patch \
            "
 
 LINUX_KERNEL_TYPE = "tiny"