From 253ff03050a92c32995482a55713f8ec343c78f8 Mon Sep 17 00:00:00 2001
From: Dheeraj Kumar <quic_dhekum@quicinc.com>
Date: Fri, 10 Nov 2023 07:27:40 +0000
Subject: [PATCH] MobileAP: CVE-2022-2663 fix revert kernel change

Added CVE-2022-2663 fix revert kernel change

Change-Id: I0230a6bc4fd3903c918bce86a5e5728c044b3e3b
Signed-off-by: Dheeraj Kumar <quic_dhekum@quicinc.com>
---
 net/netfilter/nf_conntrack_irc.c | 40 +++++++++++++++++++++++++-------
 1 file changed, 32 insertions(+), 8 deletions(-)

diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 912e6d1a8f59..2d296830160d 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -435,15 +435,38 @@ static int help(struct sk_buff *skb, unsigned int protoff,
 		 * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14
 		 */
 		data = ib_ptr;
-		while (data < data_limit - (19 + MINMATCHLEN)) {
-			if (memcmp(data, "\1DCC ", 5)) {
+		/* Skip any whitespace */
+		while (data < data_limit - 10) {
+			if (*data == ' ' || *data == '\r' || *data == '\n')
+				data++;
+			else
+				break;
+		}
+
+		/* strlen("PRIVMSG x ")=10 */
+		if (data < data_limit - 10) {
+			if (strncasecmp("PRIVMSG ", data, 8))
+				goto out;
+			data += 8;
+		}
+
+		/* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26
+		 * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26
+		 */
+		while (data < data_limit - (21 + MINMATCHLEN)) {
+			/* Find first " :", the start of message */
+			if (memcmp(data, " :", 2)) {
 				data++;
 				continue;
 			}
+			data += 2;
+
+			/* then check that place only for the DCC command */
+			if (memcmp(data, "\1DCC ", 5))
+				goto out;
 			data += 5;
-			/* we have at least (19+MINMATCHLEN)-5
-			 *bytes valid data left
-			 */
+			/* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */
+
 			iph = ip_hdr(skb);
 			pr_debug("DCC found in master %pI4:%u %pI4:%u\n",
 				 &iph->saddr, ntohs(th->source),
@@ -459,7 +482,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
 				pr_debug("DCC %s detected\n", dccprotos[i]);
 
 				/* we have at least
-				 * (19+MINMATCHLEN)-5-dccprotos[i].matchlen
+				 * (21+MINMATCHLEN)-7-dccprotos[i].matchlen
 				 *bytes valid data left (== 14/13 bytes)
 				 */
 				if (parse_dcc(data, data_limit, &dcc_ip,
@@ -476,8 +499,9 @@ static int help(struct sk_buff *skb, unsigned int protoff,
 				 *external (NAT'ed) IP
 				 */
 				tuple = &ct->tuplehash[dir].tuple;
-				if (tuple->src.u3.ip != dcc_ip &&
-				    tuple->dst.u3.ip != dcc_ip) {
+				if ((tuple->src.u3.ip != dcc_ip &&
+				     ct->tuplehash[!dir].tuple.dst.u3.ip != dcc_ip) ||
+				    dcc_port == 0) {
 					net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n",
 							     &tuple->src.u3.ip,
 							     &dcc_ip, dcc_port);