ACK: [SRU][J/F][PATCH 0/1] CVE-2024-38538

[Mehmet Basaran]

Acked-by: Mehmet Basaran <mehmet.basaran at canonical.com>

-------------- next part --------------
Koichiro Den <koichiro.den at canonical.com> writes:

> [Impact]
>
> net: bridge: xmit: make sure we have at least eth header len bytes
> syzbot triggered an uninit value error in bridge device's xmit path
> by sending a short (less than ETH_HLEN bytes) skb. To fix it check if
> we can actually pull that amount instead of assuming.
>
> Tested with dropwatch:
>  drop at: br_dev_xmit+0xb93/0x12d0 [bridge] (0xffffffffc06739b3)
>  origin: software
>  timestamp: Mon May 13 11:31:53 2024 778214037 nsec
>  protocol: 0x88a8
>  length: 2
>  original length: 2
>  drop reason: PKT_TOO_SMALL
>
> [Backport]
>
> For Jammy, adjusted context due to missing commits:
> - 7b4858df3bf7 ("skbuff: bridge: Add layer 2 miss indication")
> - 1fb2d41501f3 ("net: add pskb_may_pull_reason() helper")
>
> For Focal, adjusted context due to missing commits:
> - 7b4858df3bf7 ("skbuff: bridge: Add layer 2 miss indication")
> - 1fb2d41501f3 ("net: add pskb_may_pull_reason() helper")
> - c504e5c2f964 ("net: skb: introduce kfree_skb_reason()")
>
> [Fix]
>
> Noble:  fixed via stable
> Jammy:  Backport - adjusted contexts, see [Backport]
> Focal:  Backport - adjusted contexts, see [Backport]
> Bionic: fix sent to esm ML
> Xenial: fix sent to esm ML
> Trusty: won't fix
>
> [Test case]
>
> Compile and boot tested.
> Also stress-tested by the syzbot repro.
>
> [Where problem could occur]
>
> This fix impacts bridge xmit path, an issue with this fix would be
> visible to the user via KMSAN splat if enabled.
>
>
> Nikolay Aleksandrov (1):
>   net: bridge: xmit: make sure we have at least eth header len bytes
>
>  net/bridge/br_device.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> -- 
> 2.43.0
>
>
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 873 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240924/c015bd71/attachment.sig>