From 5e6193026858039b0015b6adfd4fe37955b1d222 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Wed, 2 Nov 2016 12:13:31 +0100 Subject: kernel: scsi: aacraid: CVE-2016-6480 Fixes double fetch in ioctl_send_fib(). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6480 Upstream bug: https://bugzilla.kernel.org/show_bug.cgi?id=116751 Upstream fix: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/patch/?id=e4878ef66e5b8d01d6734b1952f9abb3eeea454c Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau --- recipes-kernel/linux/files/CVE-2016-6480.patch | 71 ++++++++++++++++++++++++++ recipes-kernel/linux/linux-yocto_4.%.bbappend | 1 + 2 files changed, 72 insertions(+) create mode 100644 recipes-kernel/linux/files/CVE-2016-6480.patch diff --git a/recipes-kernel/linux/files/CVE-2016-6480.patch b/recipes-kernel/linux/files/CVE-2016-6480.patch new file mode 100644 index 0000000..2cd521a --- /dev/null +++ b/recipes-kernel/linux/files/CVE-2016-6480.patch @@ -0,0 +1,71 @@ +From e4878ef66e5b8d01d6734b1952f9abb3eeea454c Mon Sep 17 00:00:00 2001 +From: Dave Carroll +Date: Fri, 5 Aug 2016 13:44:10 -0600 +Subject: aacraid: Check size values after double-fetch from user + +commit fa00c437eef8dc2e7b25f8cd868cfa405fcc2bb3 upstream. + +In aacraid's ioctl_send_fib() we do two fetches from userspace, one the +get the fib header's size and one for the fib itself. Later we use the +size field from the second fetch to further process the fib. If for some +reason the size from the second fetch is different than from the first +fix, we may encounter an out-of- bounds access in aac_fib_send(). We +also check the sender size to insure it is not out of bounds. This was +reported in https://bugzilla.kernel.org/show_bug.cgi?id=116751 and was +assigned CVE-2016-6480. + +CVE: CVE-2016-6480 +Upstream-Status: Backport + +Reported-by: Pengfei Wang +Fixes: 7c00ffa31 '[SCSI] 2.6 aacraid: Variable FIB size (updated patch)' +Signed-off-by: Dave Carroll +Reviewed-by: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sona Sarmadi +--- + drivers/scsi/aacraid/commctrl.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c +index 54195a1..f78cc94 100644 +--- a/drivers/scsi/aacraid/commctrl.c ++++ b/drivers/scsi/aacraid/commctrl.c +@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) + struct fib *fibptr; + struct hw_fib * hw_fib = (struct hw_fib *)0; + dma_addr_t hw_fib_pa = (dma_addr_t)0LL; +- unsigned size; ++ unsigned int size, osize; + int retval; + + if (dev->in_reset) { +@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) + * will not overrun the buffer when we copy the memory. Return + * an error if we would. + */ +- size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr); ++ osize = size = le16_to_cpu(kfib->header.Size) + ++ sizeof(struct aac_fibhdr); + if (size < le16_to_cpu(kfib->header.SenderSize)) + size = le16_to_cpu(kfib->header.SenderSize); + if (size > dev->max_fib_size) { +@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg) + goto cleanup; + } + ++ /* Sanity check the second copy */ ++ if ((osize != le16_to_cpu(kfib->header.Size) + ++ sizeof(struct aac_fibhdr)) ++ || (size < le16_to_cpu(kfib->header.SenderSize))) { ++ retval = -EINVAL; ++ goto cleanup; ++ } ++ + if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) { + aac_adapter_interrupt(dev); + /* +-- +cgit v0.12 + diff --git a/recipes-kernel/linux/linux-yocto_4.%.bbappend b/recipes-kernel/linux/linux-yocto_4.%.bbappend index a81ff39..1a22b88 100644 --- a/recipes-kernel/linux/linux-yocto_4.%.bbappend +++ b/recipes-kernel/linux/linux-yocto_4.%.bbappend @@ -8,6 +8,7 @@ SRC_URI += "file://hid-CVE-2016-5829.patch \ file://CVE-2016-4951.patch \ file://CVE-2016-5195.patch \ file://CVE-2016-5400.patch \ + file://CVE-2016-6480.patch \ " ENEA_KERNEL_FRAGMENTS += "\ -- cgit v1.2.3-54-g00ecf