[kernel] r8315 - in dists/sid/linux-2.6/debian: . patches/bugfix patches/series

[maximilian attems]

Author: maks-guest
Date: Tue Feb 20 11:44:20 2007
New Revision: 8315

Added:
   dists/sid/linux-2.6/debian/patches/bugfix/nfs-acl-free-wrong-pointer.patch
Modified:
   dists/sid/linux-2.6/debian/changelog
   dists/sid/linux-2.6/debian/patches/series/11
Log:
add 2.6.18.7 nfs acl security fix


Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog	(original)
+++ dists/sid/linux-2.6/debian/changelog	Tue Feb 20 11:44:20 2007
@@ -24,8 +24,10 @@
   * Forward port complete IPX checksum patch 2.6.16.34
   * From the 2.6.18 stable queue:
     - IB/mad: Fix race between cancel and receive completion
+  * Add 2.6.18.7, thanks gregkh:
+    - Fix a free-wrong-pointer bug in nfs/acl server (CVE-2007-0772)
 
- -- maximilian attems <maks at sternwelten.at>  Mon, 19 Feb 2007 17:31:22 +0100
+ -- maximilian attems <maks at sternwelten.at>  Tue, 20 Feb 2007 11:41:20 +0100
 
 linux-2.6 (2.6.18.dfsg.1-10) unstable; urgency=low
 

Added: dists/sid/linux-2.6/debian/patches/bugfix/nfs-acl-free-wrong-pointer.patch
==============================================================================
--- (empty file)
+++ dists/sid/linux-2.6/debian/patches/bugfix/nfs-acl-free-wrong-pointer.patch	Tue Feb 20 11:44:20 2007
@@ -0,0 +1,45 @@
+diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
+index fc95c4d..c318b6f 100644
+--- a/fs/nfsd/nfs2acl.c
++++ b/fs/nfsd/nfs2acl.c
+@@ -287,13 +287,20 @@ static int nfsaclsvc_release_getacl(struct svc_rqst *rqstp, u32 *p,
+ 	return 1;
+ }
+ 
+-static int nfsaclsvc_release_fhandle(struct svc_rqst *rqstp, u32 *p,
+-		struct nfsd_fhandle *resp)
++static int nfsaclsvc_release_attrstat(struct svc_rqst *rqstp, u32 *p,
++		struct nfsd_attrstat *resp)
+ {
+ 	fh_put(&resp->fh);
+ 	return 1;
+ }
+ 
++static int nfsaclsvc_release_access(struct svc_rqst *rqstp, u32 *p,
++               struct nfsd3_accessres *resp)
++{
++       fh_put(&resp->fh);
++       return 1;
++}
++
+ #define nfsaclsvc_decode_voidargs	NULL
+ #define nfsaclsvc_encode_voidres	NULL
+ #define nfsaclsvc_release_void		NULL
+@@ -322,9 +329,9 @@ struct nfsd3_voidargs { int dummy; };
+ static struct svc_procedure		nfsd_acl_procedures2[] = {
+   PROC(null,	void,		void,		void,	  RC_NOCACHE, ST),
+   PROC(getacl,	getacl,		getacl,		getacl,	  RC_NOCACHE, ST+1+2*(1+ACL)),
+-  PROC(setacl,	setacl,		attrstat,	fhandle,  RC_NOCACHE, ST+AT),
+-  PROC(getattr, fhandle,	attrstat,	fhandle,  RC_NOCACHE, ST+AT),
+-  PROC(access,	access,		access,		fhandle,  RC_NOCACHE, ST+AT+1),
++  PROC(setacl,	setacl,		attrstat,	attrstat, RC_NOCACHE, ST+AT),
++  PROC(getattr, fhandle,	attrstat,	attrstat, RC_NOCACHE, ST+AT),
++  PROC(access,	access,		access,		access,   RC_NOCACHE, ST+AT+1),
+ };
+ 
+ struct svc_version	nfsd_acl_version2 = {
+-
+To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at  http://vger.kernel.org/majordomo-info.html
+Please read the FAQ at  http://www.tux.org/lkml/

Modified: dists/sid/linux-2.6/debian/patches/series/11
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/11	(original)
+++ dists/sid/linux-2.6/debian/patches/series/11	Tue Feb 20 11:44:20 2007
@@ -5,3 +5,4 @@
 + bugfix/net-ipx-annotation-checksum.patch
 + bugfix/ib-mad-fix-race-between-cancel-and-receive-completion.patch
 + bugfix/sparc/sbus-envctrl-remove-execve.patch
++ bugfix/nfs-acl-free-wrong-pointer.patch