[kernel] r15851 - in dists/lenny/linux-2.6/debian: . patches/bugfix/all patches/series

Dann Frazier dannf at alioth.debian.org
Thu Jun 10 22:36:58 UTC 2010


Author: dannf
Date: Thu Jun 10 22:36:57 2010
New Revision: 15851

Log:
sctp: fix append error cause to ERROR chunk correctly
(a further fix for CVE-2010-1173)

Added:
   dists/lenny/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch
      - copied unchanged from r15847, dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch
Modified:
   dists/lenny/linux-2.6/debian/changelog
   dists/lenny/linux-2.6/debian/patches/series/23

Modified: dists/lenny/linux-2.6/debian/changelog
==============================================================================
--- dists/lenny/linux-2.6/debian/changelog	Thu Jun 10 22:27:26 2010	(r15850)
+++ dists/lenny/linux-2.6/debian/changelog	Thu Jun 10 22:36:57 2010	(r15851)
@@ -3,7 +3,9 @@
   [ dann frazier ]
   * x86: check boundary in setup_node_bootmem() (Closes: 569704)
   * sunxvr500: Ignore secondary output PCI devices (Closes: #580422)
-  
+  * sctp: fix append error cause to ERROR chunk correctly
+    (a further fix for CVE-2010-1173)
+
   [ Ben Hutchings ]
   * [sparc64] Fix definition of VMEMMAP_SIZE (Closes: #509202)
   * megaraid_sas: Version and documentation update (Closes: #547183)

Copied: dists/lenny/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch (from r15847, dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch)
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/lenny/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch	Thu Jun 10 22:36:57 2010	(r15851, copy of r15847, dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch)
@@ -0,0 +1,46 @@
+From: Wei Yongjun <yjwei at cn.fujitsu.com>
+Date: Mon, 17 May 2010 22:51:58 -0700
+Subject: [PATCH] sctp: fix append error cause to ERROR chunk correctly
+
+commit 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 upstream.
+
+commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809
+  sctp: Fix skb_over_panic resulting from multiple invalid \
+    parameter errors (CVE-2010-1173) (v4)
+
+cause 'error cause' never be add the the ERROR chunk due to
+some typo when check valid length in sctp_init_cause_fixed().
+
+Signed-off-by: Wei Yongjun <yjwei at cn.fujitsu.com>
+Reviewed-by: Neil Horman <nhorman at tuxdriver.com>
+Acked-by: Vlad Yasevich <vladislav.yasevich at hp.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+---
+ net/sctp/sm_make_chunk.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index d8261f3..bd2a50b 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -141,7 +141,7 @@ int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
+ 	len = sizeof(sctp_errhdr_t) + paylen;
+ 	err.length  = htons(len);
+ 
+-	if (skb_tailroom(chunk->skb) >  len)
++	if (skb_tailroom(chunk->skb) < len)
+ 		return -ENOSPC;
+ 	chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
+ 						     sizeof(sctp_errhdr_t),
+@@ -1415,7 +1415,7 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
+ void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
+ 			     int len, const void *data)
+ {
+-	if (skb_tailroom(chunk->skb) > len)
++	if (skb_tailroom(chunk->skb) >= len)
+ 		return sctp_addto_chunk(chunk, len, data);
+ 	else
+ 		return NULL;
+-- 
+1.7.1
+

Modified: dists/lenny/linux-2.6/debian/patches/series/23
==============================================================================
--- dists/lenny/linux-2.6/debian/patches/series/23	Thu Jun 10 22:27:26 2010	(r15850)
+++ dists/lenny/linux-2.6/debian/patches/series/23	Thu Jun 10 22:36:57 2010	(r15851)
@@ -13,3 +13,4 @@
 + bugfix/mips/fpu-emulator.patch
 + bugfix/x86/x86-completely-disable-NOPL-on-32-bits.patch
 + bugfix/all/virtio_blk-dont-bounce-highmem-requests.patch
++ bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch



More information about the Kernel-svn-changes mailing list