[kernel] r15841 - in dists/sid/linux-2.6/debian: . patches/bugfix/all patches/series
Ben Hutchings
benh at alioth.debian.org
Tue Jun 8 02:39:02 UTC 2010
Author: benh
Date: Tue Jun 8 02:38:58 2010
New Revision: 15841
Log:
sctp: fix append error cause to ERROR chunk correctly
Fix regression due to fix for CVE-2010-1173
Added:
dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/16
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog Tue Jun 8 02:13:53 2010 (r15840)
+++ dists/sid/linux-2.6/debian/changelog Tue Jun 8 02:38:58 2010 (r15841)
@@ -13,6 +13,8 @@
* Update Spanish debconf templates, thanks to Omar Campagne
(Closes: #580538)
* Revert "Add EC path for Thinkpad X100."; it is incomplete and broken
+ * sctp: fix append error cause to ERROR chunk correctly (regression due
+ to fix for CVE-2010-1173)
[ Aurelien Jarno ]
* [sh4] fix sh_tmu clocksource following recent nohz changes.
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch Tue Jun 8 02:38:58 2010 (r15841)
@@ -0,0 +1,46 @@
+From: Wei Yongjun <yjwei at cn.fujitsu.com>
+Date: Mon, 17 May 2010 22:51:58 -0700
+Subject: [PATCH] sctp: fix append error cause to ERROR chunk correctly
+
+commit 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 upstream.
+
+commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809
+ sctp: Fix skb_over_panic resulting from multiple invalid \
+ parameter errors (CVE-2010-1173) (v4)
+
+cause 'error cause' never be add the the ERROR chunk due to
+some typo when check valid length in sctp_init_cause_fixed().
+
+Signed-off-by: Wei Yongjun <yjwei at cn.fujitsu.com>
+Reviewed-by: Neil Horman <nhorman at tuxdriver.com>
+Acked-by: Vlad Yasevich <vladislav.yasevich at hp.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+---
+ net/sctp/sm_make_chunk.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index d8261f3..bd2a50b 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -141,7 +141,7 @@ int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
+ len = sizeof(sctp_errhdr_t) + paylen;
+ err.length = htons(len);
+
+- if (skb_tailroom(chunk->skb) > len)
++ if (skb_tailroom(chunk->skb) < len)
+ return -ENOSPC;
+ chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
+ sizeof(sctp_errhdr_t),
+@@ -1415,7 +1415,7 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
+ void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
+ int len, const void *data)
+ {
+- if (skb_tailroom(chunk->skb) > len)
++ if (skb_tailroom(chunk->skb) >= len)
+ return sctp_addto_chunk(chunk, len, data);
+ else
+ return NULL;
+--
+1.7.1
+
Modified: dists/sid/linux-2.6/debian/patches/series/16
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/16 Tue Jun 8 02:13:53 2010 (r15840)
+++ dists/sid/linux-2.6/debian/patches/series/16 Tue Jun 8 02:38:58 2010 (r15841)
@@ -125,3 +125,4 @@
+ features/all/mantis/0121-V4L-DVB-mantis-Select-correct-frontends.patch
+ features/all/revert-ipv4-Make-INET_LRO-a-bool-instead-of-tristate.patch
- bugfix/all/thinkpad-acpi-add-x100e.patch
++ bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch
More information about the Kernel-svn-changes
mailing list