kernel: CVE-2016-10229krogoth

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2016-10229

Reference to upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=v3.12.74&id=c3bfbecb1bb575278ce4812746a29c04875a2926

Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>

2 files changed, 102 insertions, 0 deletions

diff --git a/recipes-kernel/linux/files/CVE-2016-10229.patch b/recipes-kernel/linux/files/CVE-2016-10229.patch
new file mode 100644
index 0000000..287200c
--- /dev/null
+++ b/recipes-kernel/linux/files/CVE-2016-10229.patch
@@ -0,0 +1,101 @@
+From c3bfbecb1bb575278ce4812746a29c04875a2926 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 30 Dec 2015 08:51:12 -0500
+Subject: udp: properly support MSG_PEEK with truncated buffers
+
+commit 197c949e7798fbf28cfadc69d9ca0c2abbf93191 upstream.
+
+Backport of this upstream commit into stable kernels :
+89c22d8c3b27 ("net: Fix skb csum races when peeking")
+exposed a bug in udp stack vs MSG_PEEK support, when user provides
+a buffer smaller than skb payload.
+
+In this case,
+skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr),
+                                 msg->msg_iov);
+returns -EFAULT.
+
+This bug does not happen in upstream kernels since Al Viro did a great
+job to replace this into :
+skb_copy_and_csum_datagram_msg(skb, sizeof(struct udphdr), msg);
+This variant is safe vs short buffers.
+
+For the time being, instead reverting Herbert Xu patch and add back
+skb->ip_summed invalid changes, simply store the result of
+udp_lib_checksum_complete() so that we avoid computing the checksum a
+second time, and avoid the problematic
+skb_copy_and_csum_datagram_iovec() call.
+
+This patch can be applied on recent kernels as it avoids a double
+checksumming, then backported to stable kernels as a bug fix.
+
+CVE: CVE-2016-10229
+Upstream-Status: Backport
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ net/ipv4/udp.c | 6 ++++--
+ net/ipv6/udp.c | 6 ++++--
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 4908eaa..f8e3046 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1210,6 +1210,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+        int peeked, off = 0;
+        int err;
+        int is_udplite = IS_UDPLITE(sk);
++       bool checksum_valid = false;
+        bool slow;
+ 
+        if (flags & MSG_ERRQUEUE)
+@@ -1235,11 +1236,12 @@ try_again:
+         */
+ 
+        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+-               if (udp_lib_checksum_complete(skb))
++               checksum_valid = !udp_lib_checksum_complete(skb);
++               if (!checksum_valid)
+                        goto csum_copy_err;
+        }
+ 
+-       if (skb_csum_unnecessary(skb))
++       if (checksum_valid || skb_csum_unnecessary(skb))
+                err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
+                                              msg->msg_iov, copied);
+        else {
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index a6c5ef5..94ca417 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -371,6 +371,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
+        int peeked, off = 0;
+        int err;
+        int is_udplite = IS_UDPLITE(sk);
++       bool checksum_valid = false;
+        int is_udp4;
+        bool slow;
+ 
+@@ -402,11 +403,12 @@ try_again:
+         */
+ 
+        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+-               if (udp_lib_checksum_complete(skb))
++               checksum_valid = !udp_lib_checksum_complete(skb);
++               if (!checksum_valid)
+                        goto csum_copy_err;
+        }
+ 
+-       if (skb_csum_unnecessary(skb))
++       if (checksum_valid || skb_csum_unnecessary(skb))
+                err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
+                                              msg->msg_iov, copied);
+        else {
+-- 
+cgit v1.1
+
diff --git a/recipes-kernel/linux/linux-qoriq_3.12.bbappend b/recipes-kernel/linux/linux-qoriq_3.12.bbappend
index 6ecf1dd..f9ee5e6 100644
--- a/recipes-kernel/linux/linux-qoriq_3.12.bbappend
+++ b/recipes-kernel/linux/linux-qoriq_3.12.bbappend
@@ -14,5 +14,6 @@ SRC_URI += "file://ppp-CVE-2015-8569.patch \
             file://tmpfs-CVE-2017-5551.patch \
             file://0001-CVE-2017-2636.patch \
             file://0002-CVE-2017-2636.patch \
+            file://CVE-2016-10229.patch \
            "