net-kernel: CVE-2016-2070

Fixes a divide-by-zero vulnerability in a way the linux kernel processes
TCP connections. The error can occur if a connection starts another cwnd
reduction phase by setting tp->prior_cwnd to the current cwnd (0) in
tcp_init_cwnd_reduction().
A remote, unauthenticated attacker could use this flaw to crash the
kernel (denial of service).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2070

Reference to upstream correction (backported from kernel.org 4.4 branch):
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/patch/?id=8b8a321ff72c785ed5e8b4cf6eda20b35d427390

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Martin Borg <martin.borg@enea.com>

2 files changed, 68 insertions, 0 deletions

diff --git a/recipes-kernel/linux/files/net-CVE-2016-2070.patch b/recipes-kernel/linux/files/net-CVE-2016-2070.patch
new file mode 100644
index 0000000..b0e1200
--- /dev/null
+++ b/recipes-kernel/linux/files/net-CVE-2016-2070.patch
@@ -0,0 +1,67 @@
+From 8b8a321ff72c785ed5e8b4cf6eda20b35d427390 Mon Sep 17 00:00:00 2001
+From: Yuchung Cheng <ycheng@google.com>
+Date: Wed, 6 Jan 2016 12:42:38 -0800
+Subject: tcp: fix zero cwnd in tcp_cwnd_reduction
+
+Patch 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode
+conditionally") introduced a bug that cwnd may become 0 when both
+inflight and sndcnt are 0 (cwnd = inflight + sndcnt). This may lead
+to a div-by-zero if the connection starts another cwnd reduction
+phase by setting tp->prior_cwnd to the current cwnd (0) in
+tcp_init_cwnd_reduction().
+
+To prevent this we skip PRR operation when nothing is acked or
+sacked. Then cwnd must be positive in all cases as long as ssthresh
+is positive:
+
+1) The proportional reduction mode
+   inflight > ssthresh > 0
+
+2) The reduction bound mode
+  a) inflight == ssthresh > 0
+
+  b) inflight < ssthresh
+     sndcnt > 0 since newly_acked_sacked > 0 and inflight < ssthresh
+
+Therefore in all cases inflight and sndcnt can not both be 0.
+We check invalid tp->prior_cwnd to avoid potential div0 bugs.
+
+In reality this bug is triggered only with a sequence of less common
+events.  For example, the connection is terminating an ECN-triggered
+cwnd reduction with an inflight 0, then it receives reordered/old
+ACKs or DSACKs from prior transmission (which acks nothing). Or the
+connection is in fast recovery stage that marks everything lost,
+but fails to retransmit due to local issues, then receives data
+packets from other end which acks nothing.
+
+CVE: CVE-2016-2070
+Upstream-Status: Backport
+
+Fixes: 3759824da87b ("tcp: PRR uses CRB mode by default and SS mode conditionally")
+Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ net/ipv4/tcp_input.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 2d656ee..d4c5115 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2478,6 +2478,9 @@ static void tcp_cwnd_reduction(struct sock *sk, const int prior_unsacked,
+        int newly_acked_sacked = prior_unsacked -
+                                 (tp->packets_out - tp->sacked_out);
+ 
++       if (newly_acked_sacked <= 0 || WARN_ON_ONCE(!tp->prior_cwnd))
++               return;
++
+        tp->prr_delivered += newly_acked_sacked;
+        if (delta < 0) {
+                u64 dividend = (u64)tp->snd_ssthresh * tp->prr_delivered +
+-- 
+cgit v0.12
+
diff --git a/recipes-kernel/linux/linux-qoriq_3.12.bbappend b/recipes-kernel/linux/linux-qoriq_3.12.bbappend
index cc83b93..0ed4489 100644
--- a/recipes-kernel/linux/linux-qoriq_3.12.bbappend
+++ b/recipes-kernel/linux/linux-qoriq_3.12.bbappend
@@ -4,5 +4,6 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
 
 SRC_URI += "file://ppp-CVE-2015-8569.patch \
             file://net-CVE-2015-8543.patch \
+            file://net-CVE-2016-2070.patch \
            "