[kernel] r8534 - in dists/etch-security/linux-2.6/debian: . patches/bugfix patches/series

[Dann Frazier]

Author: dannf
Date: Tue May  1 14:35:22 2007
New Revision: 8534

Added:
   dists/etch-security/linux-2.6/debian/patches/bugfix/nl_fib_lookup-oops.patch
Modified:
   dists/etch-security/linux-2.6/debian/changelog
   dists/etch-security/linux-2.6/debian/patches/series/12etch2
Log:
* bugfix/nl_fib_lookup-oops.patch
  Add fix for oops bug added by previous patch

Modified: dists/etch-security/linux-2.6/debian/changelog
==============================================================================
--- dists/etch-security/linux-2.6/debian/changelog	(original)
+++ dists/etch-security/linux-2.6/debian/changelog	Tue May  1 14:35:22 2007
@@ -11,8 +11,10 @@
   * bugfix/netlink-infinite-recursion.patch
     [SECURITY] Fix infinite recursion bug in netlink
     See CVE-2007-1861
+  * bugfix/nl_fib_lookup-oops.patch
+    Add fix for oops bug added by previous patch
 
- -- dann frazier <dannf at debian.org>  Mon, 30 Apr 2007 19:45:38 -0600
+ -- dann frazier <dannf at debian.org>  Tue, 01 May 2007 08:34:18 -0600
 
 linux-2.6 (2.6.18.dfsg.1-12etch1) stable-security; urgency=high
 

Added: dists/etch-security/linux-2.6/debian/patches/bugfix/nl_fib_lookup-oops.patch
==============================================================================
--- (empty file)
+++ dists/etch-security/linux-2.6/debian/patches/bugfix/nl_fib_lookup-oops.patch	Tue May  1 14:35:22 2007
@@ -0,0 +1,34 @@
+From: Sergey Vlasov <vsu at altlinux.ru>
+Date: Fri, 27 Apr 2007 09:18:35 +0000 (-0700)
+Subject: IPV4: Fix OOPS'er added to netlink fib.
+X-Git-Tag: v2.6.20.10~2
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fstable%2Flinux-2.6.20.y.git;a=commitdiff_plain;h=6af3412cff50b9a7b12b7b9cf6f01b34fbae4624
+
+IPV4: Fix OOPS'er added to netlink fib.
+
+[IPV4] nl_fib_lookup: Initialise res.r before fib_res_put(&res)
+
+When CONFIG_IP_MULTIPLE_TABLES is enabled, the code in nl_fib_lookup()
+needs to initialize the res.r field before fib_res_put(&res) - unlike
+fib_lookup(), a direct call to ->tb_lookup does not set this field.
+
+Signed-off-by: Sergey Vlasov <vsu at altlinux.ru>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+---
+
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index fa2cb8c..30aae76 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -773,6 +773,10 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb )
+ 							    .tos = frn->fl_tos,
+ 							    .scope = frn->fl_scope } } };
+ 
++#ifdef CONFIG_IP_MULTIPLE_TABLES
++	res.r = NULL;
++#endif
++
+ 	frn->err = -ENOENT;
+ 	if (tb) {
+ 		local_bh_disable();

Modified: dists/etch-security/linux-2.6/debian/patches/series/12etch2
==============================================================================
--- dists/etch-security/linux-2.6/debian/patches/series/12etch2	(original)
+++ dists/etch-security/linux-2.6/debian/patches/series/12etch2	Tue May  1 14:35:22 2007
@@ -1,3 +1,4 @@
 + bugfix/nfnetlink_log-null-deref.patch
 + bugfix/nf_conntrack-set-nfctinfo.patch
 + bugfix/netlink-infinite-recursion.patch
++ bugfix/nl_fib_lookup-oops.patch