From 4f88be3f5aca8b19343fe093ac2790890e0c36f0 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Wed, 2 Nov 2016 12:13:26 +0100 Subject: kernel: scsi: aacraid: CVE-2016-6480 Fixes double fetch in ioctl_send_fib(). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6480 Upstream bug: https://bugzilla.kernel.org/show_bug.cgi?id=116751 Upstream fix: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/patch/?id=bcc85e09fc60d2e99053eae3fd0515c343189375 Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau --- recipes-kernel/linux/linux-ls1/CVE-2016-6480.patch | 72 ++++++++++++++++++++++ recipes-kernel/linux/linux-ls1_3.12.bbappend | 1 + 2 files changed, 73 insertions(+) create mode 100644 recipes-kernel/linux/linux-ls1/CVE-2016-6480.patch diff --git a/recipes-kernel/linux/linux-ls1/CVE-2016-6480.patch b/recipes-kernel/linux/linux-ls1/CVE-2016-6480.patch new file mode 100644 index 0000000..e78067e --- /dev/null +++ b/recipes-kernel/linux/linux-ls1/CVE-2016-6480.patch @@ -0,0 +1,72 @@ +From bcc85e09fc60d2e99053eae3fd0515c343189375 Mon Sep 17 00:00:00 2001 +From: Dave Carroll +Date: Fri, 5 Aug 2016 13:44:10 -0600 +Subject: aacraid: Check size values after double-fetch from user + +commit fa00c437eef8dc2e7b25f8cd868cfa405fcc2bb3 upstream. + +In aacraid's ioctl_send_fib() we do two fetches from userspace, one the +get the fib header's size and one for the fib itself. Later we use the +size field from the second fetch to further process the fib. If for some +reason the size from the second fetch is different than from the first +fix, we may encounter an out-of- bounds access in aac_fib_send(). We +also check the sender size to insure it is not out of bounds. This was +reported in https://bugzilla.kernel.org/show_bug.cgi?id=116751 and was +assigned CVE-2016-6480. + + +CVE: CVE-2016-6480 +Upstream-Status: Backport + +Reported-by: Pengfei Wang +Fixes: 7c00ffa31 '[SCSI] 2.6 aacraid: Variable FIB size (updated patch)' +Signed-off-by: Dave Carroll +Reviewed-by: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Jiri Slaby +Signed-off-by: Sona Sarmadi +--- + drivers/scsi/aacraid/commctrl.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c +index fbcd48d..16b2db3 100644 +--- a/drivers/scsi/aacraid/commctrl.c ++++ b/drivers/scsi/aacraid/commctrl.c +@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) + struct fib *fibptr; + struct hw_fib * hw_fib = (struct hw_fib *)0; + dma_addr_t hw_fib_pa = (dma_addr_t)0LL; +- unsigned size; ++ unsigned int size, osize; + int retval; + + if (dev->in_reset) { +@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) + * will not overrun the buffer when we copy the memory. Return + * an error if we would. + */ +- size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr); ++ osize = size = le16_to_cpu(kfib->header.Size) + ++ sizeof(struct aac_fibhdr); + if (size < le16_to_cpu(kfib->header.SenderSize)) + size = le16_to_cpu(kfib->header.SenderSize); + if (size > dev->max_fib_size) { +@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) + goto cleanup; + } + ++ /* Sanity check the second copy */ ++ if ((osize != le16_to_cpu(kfib->header.Size) + ++ sizeof(struct aac_fibhdr)) ++ || (size < le16_to_cpu(kfib->header.SenderSize))) { ++ retval = -EINVAL; ++ goto cleanup; ++ } ++ + if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) { + aac_adapter_interrupt(dev); + /* +-- +cgit v0.12 + diff --git a/recipes-kernel/linux/linux-ls1_3.12.bbappend b/recipes-kernel/linux/linux-ls1_3.12.bbappend index dd43619..2bfa59c 100644 --- a/recipes-kernel/linux/linux-ls1_3.12.bbappend +++ b/recipes-kernel/linux/linux-ls1_3.12.bbappend @@ -9,6 +9,7 @@ SRC_URI += "file://ls1021aiot.dts \ file://net-CVE-2016-5696.patch \ file://CVE-2016-3136.patch \ file://CVE-2016-5195.patch \ + file://CVE-2016-6480.patch \ " # fix err: "linux-ls1-3.12-r0 do_deploy: Taskhash mismatch" -- cgit v1.2.3-54-g00ecf