Or Cohen 1c3886dc30 net/packet: fix overflow in tpacket_rcv ... commit acf69c946233259ab4d64f8869d4037a198c7f06 upstream. Using tp_reserve to calculate netoff can overflow as tp_reserve is unsigned int and netoff is unsigned short. This may lead to macoff receving a smaller value then sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr is set, an out-of-bounds write will occur when calling virtio_net_hdr_from_skb. The bug is fixed by converting netoff to unsigned int and checking if it exceeds USHRT_MAX. This addresses CVE-2020-14386 Fixes: 8913336a7e ("packet: add PACKET_RESERVE sockopt") Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> [ snu: backported to pre-5.3, changed tp_drops counting/locking ] Signed-off-by: Stefan Nuernberger <snu@amazon.com> CC: David Woodhouse <dwmw@amazon.co.uk> CC: Amit Shah <aams@amazon.com> CC: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-10-07 08:00:08 +02:00
..
af_packet.c	net/packet: fix overflow in tpacket_rcv	2020-10-07 08:00:08 +02:00
diag.c	packet: pdiag_put_ring() should return TX_RING info for TPACKET_V3	2017-01-10 21:02:42 -05:00
internal.h	net/packet: tpacket_rcv: avoid a producer race condition	2020-04-02 15:28:11 +02:00
Kconfig
Makefile