[kernel] r15851 - in dists/lenny/linux-2.6/debian: . patches/bugfix/all patches/series
Dann Frazier
dannf at alioth.debian.org
Thu Jun 10 22:36:58 UTC 2010
Author: dannf
Date: Thu Jun 10 22:36:57 2010
New Revision: 15851
Log:
sctp: fix append error cause to ERROR chunk correctly
(a further fix for CVE-2010-1173)
Added:
dists/lenny/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch
- copied unchanged from r15847, dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch
Modified:
dists/lenny/linux-2.6/debian/changelog
dists/lenny/linux-2.6/debian/patches/series/23
Modified: dists/lenny/linux-2.6/debian/changelog
==============================================================================
--- dists/lenny/linux-2.6/debian/changelog Thu Jun 10 22:27:26 2010 (r15850)
+++ dists/lenny/linux-2.6/debian/changelog Thu Jun 10 22:36:57 2010 (r15851)
@@ -3,7 +3,9 @@
[ dann frazier ]
* x86: check boundary in setup_node_bootmem() (Closes: 569704)
* sunxvr500: Ignore secondary output PCI devices (Closes: #580422)
-
+ * sctp: fix append error cause to ERROR chunk correctly
+ (a further fix for CVE-2010-1173)
+
[ Ben Hutchings ]
* [sparc64] Fix definition of VMEMMAP_SIZE (Closes: #509202)
* megaraid_sas: Version and documentation update (Closes: #547183)
Copied: dists/lenny/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch (from r15847, dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/lenny/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch Thu Jun 10 22:36:57 2010 (r15851, copy of r15847, dists/sid/linux-2.6/debian/patches/bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch)
@@ -0,0 +1,46 @@
+From: Wei Yongjun <yjwei at cn.fujitsu.com>
+Date: Mon, 17 May 2010 22:51:58 -0700
+Subject: [PATCH] sctp: fix append error cause to ERROR chunk correctly
+
+commit 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 upstream.
+
+commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809
+ sctp: Fix skb_over_panic resulting from multiple invalid \
+ parameter errors (CVE-2010-1173) (v4)
+
+cause 'error cause' never be add the the ERROR chunk due to
+some typo when check valid length in sctp_init_cause_fixed().
+
+Signed-off-by: Wei Yongjun <yjwei at cn.fujitsu.com>
+Reviewed-by: Neil Horman <nhorman at tuxdriver.com>
+Acked-by: Vlad Yasevich <vladislav.yasevich at hp.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+---
+ net/sctp/sm_make_chunk.c | 4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index d8261f3..bd2a50b 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -141,7 +141,7 @@ int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
+ len = sizeof(sctp_errhdr_t) + paylen;
+ err.length = htons(len);
+
+- if (skb_tailroom(chunk->skb) > len)
++ if (skb_tailroom(chunk->skb) < len)
+ return -ENOSPC;
+ chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
+ sizeof(sctp_errhdr_t),
+@@ -1415,7 +1415,7 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
+ void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
+ int len, const void *data)
+ {
+- if (skb_tailroom(chunk->skb) > len)
++ if (skb_tailroom(chunk->skb) >= len)
+ return sctp_addto_chunk(chunk, len, data);
+ else
+ return NULL;
+--
+1.7.1
+
Modified: dists/lenny/linux-2.6/debian/patches/series/23
==============================================================================
--- dists/lenny/linux-2.6/debian/patches/series/23 Thu Jun 10 22:27:26 2010 (r15850)
+++ dists/lenny/linux-2.6/debian/patches/series/23 Thu Jun 10 22:36:57 2010 (r15851)
@@ -13,3 +13,4 @@
+ bugfix/mips/fpu-emulator.patch
+ bugfix/x86/x86-completely-disable-NOPL-on-32-bits.patch
+ bugfix/all/virtio_blk-dont-bounce-highmem-requests.patch
++ bugfix/all/sctp-fix-append-error-cause-to-ERROR-chunk-correctly.patch
More information about the Kernel-svn-changes
mailing list