r4076 - in branches/dist/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches: . series

[Simon Horman]

Author: horms
Date: 2005-08-31 07:53:02 +0000 (Wed, 31 Aug 2005)
New Revision: 4076

Added:
   branches/dist/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fix-dst-leak-in-icmp_push_reply.patch
Modified:
   branches/dist/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-17
Log:
  * fix-dst-leak-in-icmp_push_reply.patch
    [Maybe-Security] Fix DST leak in icmp_push_reply()
    From 2.6.12.6


Added: branches/dist/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fix-dst-leak-in-icmp_push_reply.patch
===================================================================
--- branches/dist/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fix-dst-leak-in-icmp_push_reply.patch	2005-08-30 10:30:05 UTC (rev 4075)
+++ branches/dist/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/fix-dst-leak-in-icmp_push_reply.patch	2005-08-31 07:53:02 UTC (rev 4076)
@@ -0,0 +1,40 @@
+From linux-kernel-owner+chrisw=40osdl.org-S932397AbVHRS7i at vger.kernel.org Thu Aug 18 12:00:13 2005
+Date:   Thu, 18 Aug 2005 20:59:37 +0200
+From: Patrick McHardy <kaber at trash.net>
+To: Ollie Wild <aaw at rincewind.tv>
+CC: linux-kernel at vger.kernel.org, Maillist netdev <netdev at oss.sgi.com>
+Subject: [IPV4]: Fix DST leak in icmp_push_reply()
+
+Based upon a bug report and initial patch by
+Ollie Wild.
+
+Signed-off-by: Patrick McHardy <kaber at trash.net>
+Signed-off-by: "David S. Miller" <davem at davemloft.net>
+Signed-off-by: Chris Wright <chrisw at osdl.org>
+---
+ net/ipv4/icmp.c |   12 ++++++------
+ 1 files changed, 6 insertions(+), 6 deletions(-)
+
+Index: linux-2.6.12.y/net/ipv4/icmp.c
+===================================================================
+--- linux-2.6.12.y.orig/net/ipv4/icmp.c
++++ linux-2.6.12.y/net/ipv4/icmp.c
+@@ -349,12 +349,12 @@ static void icmp_push_reply(struct icmp_
+ {
+ 	struct sk_buff *skb;
+ 
+-	ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param,
+-		       icmp_param->data_len+icmp_param->head_len,
+-		       icmp_param->head_len,
+-		       ipc, rt, MSG_DONTWAIT);
+-
+-	if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) {
++	if (ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param,
++		           icmp_param->data_len+icmp_param->head_len,
++		           icmp_param->head_len,
++		           ipc, rt, MSG_DONTWAIT) < 0)
++		ip_flush_pending_frames(icmp_socket->sk);
++	else if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) {
+ 		struct icmphdr *icmph = skb->h.icmph;
+ 		unsigned int csum = 0;
+ 		struct sk_buff *skb1;

Modified: branches/dist/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-17
===================================================================
--- branches/dist/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-17	2005-08-30 10:30:05 UTC (rev 4075)
+++ branches/dist/sarge/kernel/source/kernel-source-2.6.8-2.6.8/debian/patches/series/2.6.8-17	2005-08-31 07:53:02 UTC (rev 4076)
@@ -1,5 +1,5 @@
 + mckinley_icache.dpatch
-drivers-net-via-rhine-wol-oops.dpatch
+- drivers-net-via-rhine-wol-oops.dpatch
 + arch-x86_64-kernel-ptrace-boundary-check.dpatch
 + arch-x86_64-kernel-ptrace-canonical-rip-1.dpatch
 + arch-x86_64-kernel-ptrace-canonical-rip-2.dpatch
@@ -54,3 +54,4 @@
 + zisofs.dpatch
 + module-per-cpu-alignment-fix.dpatch
 + net-sockglue-cap.dpatch
++ fix-dst-leak-in-icmp_push_reply.patch