[kernel] r15072 - in dists/etch-security/linux-2.6.24/debian: . patches/bugfix/all patches/series

[Dann Frazier]

Author: dannf
Date: Mon Feb  1 02:49:42 2010
New Revision: 15072

Log:
NFSv4: Fix a problem whereby a buggy server can oops the kernel
(CVE-2009-3726)

Added:
   dists/etch-security/linux-2.6.24/debian/patches/bugfix/all/nfsv4-buggy-server-oops.patch
      - copied, changed from r15068, dists/lenny-security/linux-2.6/debian/patches/bugfix/all/nfsv4-buggy-server-oops.patch
Modified:
   dists/etch-security/linux-2.6.24/debian/changelog
   dists/etch-security/linux-2.6.24/debian/patches/series/6~etchnhalf.9etch2

Modified: dists/etch-security/linux-2.6.24/debian/changelog
==============================================================================
--- dists/etch-security/linux-2.6.24/debian/changelog	Mon Feb  1 02:44:46 2010	(r15071)
+++ dists/etch-security/linux-2.6.24/debian/changelog	Mon Feb  1 02:49:42 2010	(r15072)
@@ -5,6 +5,8 @@
   * selinux: prevent local users from bypassing mmap_min_addr
     in unconfined domains (CVE-2009-2695)
   * [SCSI] gdth: Prevent negative offsets in ioctl (CVE-2009-3080)
+  * NFSv4: Fix a problem whereby a buggy server can oops the kernel
+    (CVE-2009-3726)
 
  -- dann frazier <dannf at debian.org>  Sun, 31 Jan 2010 17:17:52 -0700
 

Copied and modified: dists/etch-security/linux-2.6.24/debian/patches/bugfix/all/nfsv4-buggy-server-oops.patch (from r15068, dists/lenny-security/linux-2.6/debian/patches/bugfix/all/nfsv4-buggy-server-oops.patch)
==============================================================================
--- dists/lenny-security/linux-2.6/debian/patches/bugfix/all/nfsv4-buggy-server-oops.patch	Sun Jan 31 21:26:06 2010	(r15068, copy source)
+++ dists/etch-security/linux-2.6.24/debian/patches/bugfix/all/nfsv4-buggy-server-oops.patch	Mon Feb  1 02:49:42 2010	(r15072)
@@ -20,11 +20,12 @@
     
     Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
 
-diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
-index 38d42c2..32062c3 100644
---- a/fs/nfs/dir.c
-+++ b/fs/nfs/dir.c
-@@ -1025,12 +1025,12 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
+Adjusted to apply to Debian's 2.6.24 by dann frazier <dannf at debian.org>
+
+diff -urpN linux-source-2.6.24.orig/fs/nfs/dir.c linux-source-2.6.24/fs/nfs/dir.c
+--- linux-source-2.6.24.orig/fs/nfs/dir.c	2009-11-04 18:42:05.000000000 -0700
++++ linux-source-2.6.24/fs/nfs/dir.c	2010-01-31 19:46:34.000000000 -0700
+@@ -992,12 +992,12 @@ static struct dentry *nfs_atomic_lookup(
  				res = NULL;
  				goto out;
  			/* This turned out not to be a regular file */
@@ -38,11 +39,10 @@
  			/* case -EINVAL: */
  			default:
  				goto out;
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index df24f67..6917311 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -4093,15 +4093,23 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
+diff -urpN linux-source-2.6.24.orig/fs/nfs/nfs4proc.c linux-source-2.6.24/fs/nfs/nfs4proc.c
+--- linux-source-2.6.24.orig/fs/nfs/nfs4proc.c	2008-01-24 15:58:37.000000000 -0700
++++ linux-source-2.6.24/fs/nfs/nfs4proc.c	2010-01-31 19:46:34.000000000 -0700
+@@ -3581,15 +3581,23 @@ nfs4_proc_lock(struct file *filp, int cm
  	if (request->fl_start < 0 || request->fl_end < 0)
  		return -EINVAL;
  

Modified: dists/etch-security/linux-2.6.24/debian/patches/series/6~etchnhalf.9etch2
==============================================================================
--- dists/etch-security/linux-2.6.24/debian/patches/series/6~etchnhalf.9etch2	Mon Feb  1 02:44:46 2010	(r15071)
+++ dists/etch-security/linux-2.6.24/debian/patches/series/6~etchnhalf.9etch2	Mon Feb  1 02:49:42 2010	(r15072)
@@ -6,3 +6,4 @@
 + bugfix/all/security-seperate-lsm-specific-mmap_min_addr-abi.patch
 + bugfix/all/security-define-round_hint_to_min-when-CONFIG_SECURITY-is-off.patch
 + bugfix/all/gdth-prevent-negative-offsets-in-ioctl.patch
++ bugfix/all/nfsv4-buggy-server-oops.patch