[kernel] r11322 - in dists/sid/linux-2.6/debian: . patches/bugfix/all/stable patches/series

[Bastian Blank]

Author: waldi
Date: Wed May  7 19:47:00 2008
New Revision: 11322

Log:
Add stable release 2.6.25.2.

* debian/changelog: Update.
* debian/patches/bugfix/all/stable/2.6.25.2.patch: Add.
* debian/patches/series/2: Add new patch.


Added:
   dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.25.2.patch
Modified:
   dists/sid/linux-2.6/debian/changelog
   dists/sid/linux-2.6/debian/patches/series/2

Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog	(original)
+++ dists/sid/linux-2.6/debian/changelog	Wed May  7 19:47:00 2008
@@ -51,6 +51,10 @@
   [ Ian Campbell ]
   * [x86]: Enable Xen guest support in all i386 flavours.
 
+  [ Bastian Blank ]
+  * Add stable release 2.6.25.2:
+    - fix SMP ordering hole in fcntl_setlk() (CVE-2008-1669)
+
  -- Christian T. Steigies <cts at debian.org>  Sat, 03 May 2008 14:12:54 +0200
 
 linux-2.6 (2.6.25-1) unstable; urgency=low

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.25.2.patch
==============================================================================
--- (empty file)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.25.2.patch	Wed May  7 19:47:00 2008
@@ -0,0 +1,51 @@
+diff --git a/Makefile b/Makefile
+index 675d37c..621f7b3 100644
+diff --git a/fs/locks.c b/fs/locks.c
+index 43c0af2..159e0f6 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -1750,6 +1750,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
+ 	struct file_lock *file_lock = locks_alloc_lock();
+ 	struct flock flock;
+ 	struct inode *inode;
++	struct file *f;
+ 	int error;
+ 
+ 	if (file_lock == NULL)
+@@ -1822,7 +1823,15 @@ again:
+ 	 * Attempt to detect a close/fcntl race and recover by
+ 	 * releasing the lock that was just acquired.
+ 	 */
+-	if (!error && fcheck(fd) != filp && flock.l_type != F_UNLCK) {
++	/*
++	 * we need that spin_lock here - it prevents reordering between
++	 * update of inode->i_flock and check for it done in close().
++	 * rcu_read_lock() wouldn't do.
++	 */
++	spin_lock(&current->files->file_lock);
++	f = fcheck(fd);
++	spin_unlock(&current->files->file_lock);
++	if (!error && f != filp && flock.l_type != F_UNLCK) {
+ 		flock.l_type = F_UNLCK;
+ 		goto again;
+ 	}
+@@ -1878,6 +1887,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
+ 	struct file_lock *file_lock = locks_alloc_lock();
+ 	struct flock64 flock;
+ 	struct inode *inode;
++	struct file *f;
+ 	int error;
+ 
+ 	if (file_lock == NULL)
+@@ -1950,7 +1960,10 @@ again:
+ 	 * Attempt to detect a close/fcntl race and recover by
+ 	 * releasing the lock that was just acquired.
+ 	 */
+-	if (!error && fcheck(fd) != filp && flock.l_type != F_UNLCK) {
++	spin_lock(&current->files->file_lock);
++	f = fcheck(fd);
++	spin_unlock(&current->files->file_lock);
++	if (!error && f != filp && flock.l_type != F_UNLCK) {
+ 		flock.l_type = F_UNLCK;
+ 		goto again;
+ 	}

Modified: dists/sid/linux-2.6/debian/patches/series/2
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/2	(original)
+++ dists/sid/linux-2.6/debian/patches/series/2	Wed May  7 19:47:00 2008
@@ -1,2 +1,3 @@
 + bugfix/all/stable/2.6.25.1
 + bugfix/all/drivers-ide-piix-eee-pc.patch
++ bugfix/all/stable/2.6.25.2.patch