2 files changed, 73 insertions, 0 deletions

diff --git a/recipes-kernel/linux/linux-ls1/CVE-2016-6480.patch b/recipes-kernel/linux/linux-ls1/CVE-2016-6480.patch
new file mode 100644
index 0000000..e78067e
--- /dev/null
+++ b/recipes-kernel/linux/linux-ls1/CVE-2016-6480.patch
@@ -0,0 +1,72 @@
+From bcc85e09fc60d2e99053eae3fd0515c343189375 Mon Sep 17 00:00:00 2001
+From: Dave Carroll <david.carroll@microsemi.com>
+Date: Fri, 5 Aug 2016 13:44:10 -0600
+Subject: aacraid: Check size values after double-fetch from user
+
+commit fa00c437eef8dc2e7b25f8cd868cfa405fcc2bb3 upstream.
+
+In aacraid's ioctl_send_fib() we do two fetches from userspace, one the
+get the fib header's size and one for the fib itself. Later we use the
+size field from the second fetch to further process the fib. If for some
+reason the size from the second fetch is different than from the first
+fix, we may encounter an out-of- bounds access in aac_fib_send(). We
+also check the sender size to insure it is not out of bounds. This was
+reported in https://bugzilla.kernel.org/show_bug.cgi?id=116751 and was
+assigned CVE-2016-6480.
+
+
+CVE: CVE-2016-6480
+Upstream-Status: Backport
+
+Reported-by: Pengfei Wang <wpengfeinudt@gmail.com>
+Fixes: 7c00ffa31 '[SCSI] 2.6 aacraid: Variable FIB size (updated patch)'
+Signed-off-by: Dave Carroll <david.carroll@microsemi.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ drivers/scsi/aacraid/commctrl.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
+index fbcd48d..16b2db3 100644
+--- a/drivers/scsi/aacraid/commctrl.c
++++ b/drivers/scsi/aacraid/commctrl.c
+@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
+        struct fib *fibptr;
+        struct hw_fib * hw_fib = (struct hw_fib *)0;
+        dma_addr_t hw_fib_pa = (dma_addr_t)0LL;
+-       unsigned size;
++       unsigned int size, osize;
+        int retval;
+ 
+        if (dev->in_reset) {
+@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
+         *      will not overrun the buffer when we copy the memory. Return
+         *      an error if we would.
+         */
+-       size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr);
++       osize = size = le16_to_cpu(kfib->header.Size) +
++               sizeof(struct aac_fibhdr);
+        if (size < le16_to_cpu(kfib->header.SenderSize))
+                size = le16_to_cpu(kfib->header.SenderSize);
+        if (size > dev->max_fib_size) {
+@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
+                goto cleanup;
+        }
+ 
++       /* Sanity check the second copy */
++       if ((osize != le16_to_cpu(kfib->header.Size) +
++               sizeof(struct aac_fibhdr))
++               || (size < le16_to_cpu(kfib->header.SenderSize))) {
++               retval = -EINVAL;
++               goto cleanup;
++       }
++
+        if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) {
+                aac_adapter_interrupt(dev);
+                /*
+-- 
+cgit v0.12
+
diff --git a/recipes-kernel/linux/linux-ls1_3.12.bbappend b/recipes-kernel/linux/linux-ls1_3.12.bbappend
index dd43619..2bfa59c 100644
--- a/recipes-kernel/linux/linux-ls1_3.12.bbappend
+++ b/recipes-kernel/linux/linux-ls1_3.12.bbappend
@@ -9,6 +9,7 @@ SRC_URI += "file://ls1021aiot.dts \
             file://net-CVE-2016-5696.patch \
             file://CVE-2016-3136.patch \
             file://CVE-2016-5195.patch \
+            file://CVE-2016-6480.patch \
            "
 
 # fix err: "linux-ls1-3.12-r0 do_deploy: Taskhash mismatch"