[linux] 01/08: fbdev: color map copying bounds checking (CVE-2016-8405)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch jessie-security
in repository linux.

commit 62b920d3aea6d1b2f7f7314c15aa109202266228
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Tue Feb 21 01:05:41 2017 +0000

    fbdev: color map copying bounds checking (CVE-2016-8405)
---
 debian/changelog                                   |  1 +
 .../fbdev-color-map-copying-bounds-checking.patch  | 80 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 82 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index a3bf0f2..52c04c5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -9,6 +9,7 @@ linux (3.16.39-1+deb8u1) UNRELEASED; urgency=medium
 
   [ Ben Hutchings ]
   * perf: Do not double free (dependency of fix for CVE-2017-6001)
+  * fbdev: color map copying bounds checking (CVE-2016-8405)
 
  -- Salvatore Bonaccorso <carnil at debian.org>  Sat, 18 Feb 2017 18:26:58 +0100
 
diff --git a/debian/patches/bugfix/all/fbdev-color-map-copying-bounds-checking.patch b/debian/patches/bugfix/all/fbdev-color-map-copying-bounds-checking.patch
new file mode 100644
index 0000000..7f0b091
--- /dev/null
+++ b/debian/patches/bugfix/all/fbdev-color-map-copying-bounds-checking.patch
@@ -0,0 +1,80 @@
+From: Kees Cook <keescook at chromium.org>
+Date: Tue, 24 Jan 2017 15:18:24 -0800
+Subject: fbdev: color map copying bounds checking
+Origin: https://git.kernel.org/linus/2dc705a9930b4806250fbf5a76e55266e59389f2
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2016-8405
+
+Copying color maps to userspace doesn't check the value of to->start,
+which will cause kernel heap buffer OOB read due to signedness wraps.
+
+CVE-2016-8405
+
+Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Kees Cook <keescook at chromium.org>
+Reported-by: Peter Pi (@heisecode) of Trend Micro
+Cc: Min Chong <mchong at google.com>
+Cc: Dan Carpenter <dan.carpenter at oracle.com>
+Cc: Tomi Valkeinen <tomi.valkeinen at ti.com>
+Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie at samsung.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
+---
+ drivers/video/fbdev/core/fbcmap.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c
+index f89245b8ba8e..68a113594808 100644
+--- a/drivers/video/fbdev/core/fbcmap.c
++++ b/drivers/video/fbdev/core/fbcmap.c
+@@ -163,17 +163,18 @@ void fb_dealloc_cmap(struct fb_cmap *cmap)
+ 
+ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
+ {
+-	int tooff = 0, fromoff = 0;
+-	int size;
++	unsigned int tooff = 0, fromoff = 0;
++	size_t size;
+ 
+ 	if (to->start > from->start)
+ 		fromoff = to->start - from->start;
+ 	else
+ 		tooff = from->start - to->start;
+-	size = to->len - tooff;
+-	if (size > (int) (from->len - fromoff))
+-		size = from->len - fromoff;
+-	if (size <= 0)
++	if (fromoff >= from->len || tooff >= to->len)
++		return -EINVAL;
++
++	size = min_t(size_t, to->len - tooff, from->len - fromoff);
++	if (size == 0)
+ 		return -EINVAL;
+ 	size *= sizeof(u16);
+ 
+@@ -187,17 +188,18 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
+ 
+ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
+ {
+-	int tooff = 0, fromoff = 0;
+-	int size;
++	unsigned int tooff = 0, fromoff = 0;
++	size_t size;
+ 
+ 	if (to->start > from->start)
+ 		fromoff = to->start - from->start;
+ 	else
+ 		tooff = from->start - to->start;
+-	size = to->len - tooff;
+-	if (size > (int) (from->len - fromoff))
+-		size = from->len - fromoff;
+-	if (size <= 0)
++	if (fromoff >= from->len || tooff >= to->len)
++		return -EINVAL;
++
++	size = min_t(size_t, to->len - tooff, from->len - fromoff);
++	if (size == 0)
+ 		return -EINVAL;
+ 	size *= sizeof(u16);
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 1ce4877..3e284bd 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -684,6 +684,7 @@ bugfix/all/perf-do-not-double-free.patch
 bugfix/all/perf-core-Fix-concurrent-sys_perf_event_open-vs.-mov.patch
 bugfix/all/dccp-fix-freeing-skb-too-early-for-IPV6_RECVPKTINFO.patch
 bugfix/all/sctp-avoid-BUG_ON-on-sctp_wait_for_sndbuf.patch
+bugfix/all/fbdev-color-map-copying-bounds-checking.patch
 
 # Fix ABI changes
 debian/of-fix-abi-changes.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git