From 06dfd7d3bbb3ff9d8cdcf3efb460cfd134cc5495 Mon Sep 17 00:00:00 2001
From: LemmyHuang <huangliming5@huawei.com>
Date: Tue, 8 Jun 2021 22:18:31 +0800
Subject: [PATCH] backport CVE-2021-20297

---
 NetworkManager.spec           |  9 +++-
 backport-CVE-2021-20297.patch | 77 +++++++++++++++++++++++++++++++++++
 2 files changed, 85 insertions(+), 1 deletion(-)
 create mode 100644 backport-CVE-2021-20297.patch

diff --git a/NetworkManager.spec b/NetworkManager.spec
index a8855d9..308e2b2 100644
--- a/NetworkManager.spec
+++ b/NetworkManager.spec
@@ -48,7 +48,7 @@
 Name:             NetworkManager
 Version:          1.26.2
 Epoch:            1
-Release:          5
+Release:          6
 Summary:          Network Link Manager and User Applications
 License:          GPLv2+
 URL:              https://www.gnome.org/projects/NetworkManager/
@@ -58,6 +58,7 @@ Source2:          00-server.conf
 # PATCH-FEATURE-FIX fix-wants-and-add-requires.patch --fix wants and add requires in the file of NetworkManager.service.in
 Patch1:           fix-wants-and-add-requires.patch
 Patch2:           bugfix-NetworkManager-restarting-service-on-dependency-failure.patch
+Patch3:           backport-CVE-2021-20297.patch
 
 BuildRequires:    gcc libtool pkgconfig automake autoconf intltool gettext-devel ppp-devel gnutls-devel
 BuildRequires:    dbus-devel dbus-glib-devel  glib2-devel gobject-introspection-devel jansson-devel
@@ -428,6 +429,12 @@ fi
 %{_datadir}/gtk-doc/html/NetworkManager/*
 
 %changelog
+* Tue Jun 8 2021 gaoxingwang <gaoxingwang@huawei.com> - 1.26.2-6
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:backport CVE-2021-20297
+
 * Fri Mar 12 2021 yanan <yanan@huawei.com> - 1.26.2-5
 - Type:bugfix
 - ID:NA
diff --git a/backport-CVE-2021-20297.patch b/backport-CVE-2021-20297.patch
new file mode 100644
index 0000000..731786a
--- /dev/null
+++ b/backport-CVE-2021-20297.patch
@@ -0,0 +1,77 @@
+From 420784e342da4883f6debdfe10cde68507b10d27 Mon Sep 17 00:00:00 2001
+From: Thomas Haller <thaller@redhat.com>
+Date: Wed, 24 Mar 2021 21:05:19 +0100
+Subject: [PATCH] core: fix crash in nm_wildcard_match_check()
+
+It's not entirely clear how to treat %NULL.
+Clearly "match.interface-name=eth0" should not
+match with an interface %NULL. But what about
+"match.interface-name=!eth0"? It's now implemented
+that negative matches still succeed against %NULL.
+What about "match.interface-name=*"? That probably
+should also match with %NULL. So we treat %NULL really
+like "".
+
+Against commit 11cd443448bc ('iwd: Don't call IWD methods when device
+unmanaged'), we got this backtrace:
+
+    #0  0x00007f1c164069f1 in __strnlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:62
+    #1  0x00007f1c1637ac9e in __fnmatch (pattern=<optimized out>, string=<optimized out>, string@entry=0x0, flags=flags@entry=0) at fnmatch.c:379
+            p = 0x0
+            res = <optimized out>
+            orig_pattern = <optimized out>
+            n = <optimized out>
+            wpattern = 0x7fff8d860730 L"pci-0000:03:00.0"
+            ps = {__count = 0, __value = {__wch = 0, __wchb = "\000\000\000"}}
+            wpattern_malloc = 0x0
+            wstring_malloc = 0x0
+            wstring = <optimized out>
+            alloca_used = 80
+            __PRETTY_FUNCTION__ = "__fnmatch"
+    #2  0x0000564484a978bf in nm_wildcard_match_check (str=0x0, patterns=<optimized out>, num_patterns=<optimized out>) at src/core/nm-core-utils.c:1959
+            is_inverted = 0
+            is_mandatory = 0
+            match = <optimized out>
+            p = 0x564486c43fa0 "pci-0000:03:00.0"
+            has_optional = 0
+            has_any_optional = 0
+            i = <optimized out>
+    #3  0x0000564484bf4797 in check_connection_compatible (self=<optimized out>, connection=<optimized out>, error=0x0) at src/core/devices/nm-device.c:7499
+            patterns = <optimized out>
+            device_driver = 0x564486c76bd0 "veth"
+            num_patterns = 1
+            priv = 0x564486cbe0b0
+            __func__ = "check_connection_compatible"
+            device_iface = <optimized out>
+            local = 0x564486c99a60
+            conn_iface = 0x0
+            klass = <optimized out>
+            s_match = 0x564486c63df0 [NMSettingMatch]
+    #4  0x0000564484c38491 in check_connection_compatible (device=0x564486cbe590 [NMDeviceVeth], connection=0x564486c6b160, error=0x0) at src/core/devices/nm-device-ethernet.c:348
+            self = 0x564486cbe590 [NMDeviceVeth]
+            s_wired = <optimized out>
+
+Fixes: 3ced486f4162 ('libnm/match: extend syntax for match patterns with '|', '&', '!' and '\\'')
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1942741
+---
+ src/core/nm-core-utils.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/core/nm-core-utils.c b/src/core/nm-core-utils.c
+index 6a327fa7fa..ac146be9d8 100644
+--- a/src/core/nm-core-utils.c
++++ b/src/core/nm-core-utils.c
+@@ -1847,7 +1847,8 @@ nm_wildcard_match_check(const char *str, const char *const *patterns, guint num_
+ 
+         _pattern_parse(patterns[i], &p, &is_inverted, &is_mandatory);
+ 
+-        match = (fnmatch(p, str, 0) == 0);
++        match = (fnmatch(p, str ?: "", 0) == 0);
++
+         if (is_inverted)
+             match = !match;
+ 
+-- 
+GitLab
+
-- 
Gitee