From 8db2609e76912d088d19ba0938e80c5628e58e9e Mon Sep 17 00:00:00 2001

From: Joe Lawrence <joe.lawrence@redhat.com>

Date: Thu, 3 Mar 2022 11:44:42 -0500

Subject: [KPATCH CVE-2022-0435] tipc: kpatch fixes for CVE-2022-0435

Kernels:

4.18.0-348.el8

4.18.0-348.2.1.el8_5

4.18.0-348.7.1.el8_5

4.18.0-348.12.2.el8_5

Changes since last build:

[x86_64]:

link.o: changed function: tipc_link_rcv

monitor.o: changed function: tipc_mon_rcv

[ppc64le]:

link.o: changed function: tipc_link_proto_rcv

monitor.o: changed function: tipc_mon_rcv

---------------------------

Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-8/-/merge_requests/36

Approved-by: Yannick Cote (@ycote1)

Kernels:

4.18.0-348.el8

4.18.0-348.2.1.el8_5

4.18.0-348.7.1.el8_5

4.18.0-348.12.2.el8_5

Modifications: none

commit 8b2b73e6cb7bd6d9d5af8d21f15d002a373d0a2e

Author: Xin Long <lxin@redhat.com>

Date:   Thu Feb 10 21:43:20 2022 -0500

    tipc: improve size validations for received domain records

    Bugzilla: https://bugzilla.redhat.com/2048970

    CVE: CVE-2022-0435

    Y-Commit: 0e080c279fd19325b263617515835d6ce45e88f4

    O-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2048971

    O-CVE: CVE-2022-0435

    Tested: compile only

    commit 9aa422ad326634b76309e8ff342c246800621216

    Author: Jon Maloy <jmaloy@redhat.com>

    Date:   Sat Feb 5 14:11:18 2022 -0500

        tipc: improve size validations for received domain records

        The function tipc_mon_rcv() allows a node to receive and process

        domain_record structs from peer nodes to track their views of the

        network topology.

        This patch verifies that the number of members in a received domain

        record does not exceed the limit defined by MAX_MON_DOMAIN, something

        that may otherwise lead to a stack overflow.

        tipc_mon_rcv() is called from the function tipc_link_proto_rcv(), where

        we are reading a 32 bit message data length field into a uint16.  To

        avert any risk of bit overflow, we add an extra sanity check for this in

        that function.  We cannot see that happen with the current code, but

        future designers being unaware of this risk, may introduce it by

        allowing delivery of very large (> 64k) sk buffers from the bearer

        layer.  This potential problem was identified by Eric Dumazet.

        This fixes CVE-2022-0435

        Reported-by: Samuel Page <samuel.page@appgate.com>

        Reported-by: Eric Dumazet <edumazet@google.com>

        Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework")

        Signed-off-by: Jon Maloy <jmaloy@redhat.com>

        Reviewed-by: Xin Long <lucien.xin@gmail.com>

        Reviewed-by: Samuel Page <samuel.page@appgate.com>

        Reviewed-by: Eric Dumazet <edumazet@google.com>

        Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

    Signed-off-by: Xin Long <lxin@redhat.com>

    Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>

---

 net/tipc/link.c    | 9 +++++++--

 net/tipc/monitor.c | 2 ++

 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/net/tipc/link.c b/net/tipc/link.c

index b5ed87dded2c..062ec1989c41 100644

--- a/net/tipc/link.c

+++ b/net/tipc/link.c

@@ -2165,7 +2165,7 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,

 	struct tipc_msg *hdr = buf_msg(skb);

 	struct tipc_gap_ack_blks *ga = NULL;

 	bool reply = msg_probe(hdr), retransmitted = false;

-	u16 dlen = msg_data_sz(hdr), glen = 0;

+	u32 dlen = msg_data_sz(hdr), glen = 0;

 	u16 peers_snd_nxt =  msg_next_sent(hdr);

 	u16 peers_tol = msg_link_tolerance(hdr);

 	u16 peers_prio = msg_linkprio(hdr);

@@ -2179,6 +2179,10 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,

 	void *data;

 	trace_tipc_proto_rcv(skb, false, l->name);

+

+	if (dlen > U16_MAX)

+		goto exit;

+

 	if (tipc_link_is_blocked(l) || !xmitq)

 		goto exit;

@@ -2275,7 +2279,8 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,

 		/* Receive Gap ACK blocks from peer if any */

 		glen = tipc_get_gap_ack_blks(&ga, l, hdr, true);

-

+		if(glen > dlen)

+			break;

 		tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr,

 			     &l->mon_state, l->bearer_id);

diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c

index 6dce2abf436e..a37190da5a50 100644

--- a/net/tipc/monitor.c

+++ b/net/tipc/monitor.c

@@ -465,6 +465,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr,

 	state->probing = false;

 	/* Sanity check received domain record */

+	if (new_member_cnt > MAX_MON_DOMAIN)

+		return;

 	if (dlen < dom_rec_len(arrv_dom, 0))

 		return;

 	if (dlen != dom_rec_len(arrv_dom, new_member_cnt))

-- 

2.34.1