[kernel] r16464 - in dists/sid/linux-2.6/debian: . patches/bugfix/all patches/series

[Dann Frazier]

Author: dannf
Date: Tue Oct 19 19:27:33 2010
New Revision: 16464

Log:
RDS sockets: remove unsafe kmap_atomic optimization (CVE-2010-3904)

Added:
   dists/sid/linux-2.6/debian/patches/bugfix/all/net-rds-remove-kmap_atomic-optimization.patch
Modified:
   dists/sid/linux-2.6/debian/changelog
   dists/sid/linux-2.6/debian/patches/series/26

Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog	Tue Oct 19 18:23:47 2010	(r16463)
+++ dists/sid/linux-2.6/debian/changelog	Tue Oct 19 19:27:33 2010	(r16464)
@@ -26,6 +26,7 @@
 
   [ dann frazier ]
   * Force enable DMA on MBP w/ MCP 7,1
+  * RDS sockets: remove unsafe kmap_atomic optimization (CVE-2010-3904)
 
  -- dann frazier <dannf at debian.org>  Fri, 15 Oct 2010 16:03:12 +0100
 

Added: dists/sid/linux-2.6/debian/patches/bugfix/all/net-rds-remove-kmap_atomic-optimization.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/net-rds-remove-kmap_atomic-optimization.patch	Tue Oct 19 19:27:33 2010	(r16464)
@@ -0,0 +1,45 @@
+ net/rds/page.c |   27 +++++++--------------------
+ 1 files changed, 7 insertions(+), 20 deletions(-)
+
+diff --git a/net/rds/page.c b/net/rds/page.c
+index 595a952..1dfbfea 100644
+--- a/net/rds/page.c
++++ b/net/rds/page.c
+@@ -57,30 +57,17 @@ int rds_page_copy_user(struct page *page, unsigned long offset,
+ 	unsigned long ret;
+ 	void *addr;
+ 
+-	if (to_user)
++	addr = kmap(page);
++	if (to_user) {
+ 		rds_stats_add(s_copy_to_user, bytes);
+-	else
++		ret = copy_to_user(ptr, addr + offset, bytes);
++	} else {
+ 		rds_stats_add(s_copy_from_user, bytes);
+-
+-	addr = kmap_atomic(page, KM_USER0);
+-	if (to_user)
+-		ret = __copy_to_user_inatomic(ptr, addr + offset, bytes);
+-	else
+-		ret = __copy_from_user_inatomic(addr + offset, ptr, bytes);
+-	kunmap_atomic(addr, KM_USER0);
+-
+-	if (ret) {
+-		addr = kmap(page);
+-		if (to_user)
+-			ret = copy_to_user(ptr, addr + offset, bytes);
+-		else
+-			ret = copy_from_user(addr + offset, ptr, bytes);
+-		kunmap(page);
+-		if (ret)
+-			return -EFAULT;
++		ret = copy_from_user(addr + offset, ptr, bytes);
+ 	}
++	kunmap(page);
+ 
+-	return 0;
++	return ret ? -EFAULT : 0;
+ }
+ EXPORT_SYMBOL_GPL(rds_page_copy_user);
+ 

Modified: dists/sid/linux-2.6/debian/patches/series/26
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/26	Tue Oct 19 18:23:47 2010	(r16463)
+++ dists/sid/linux-2.6/debian/patches/series/26	Tue Oct 19 19:27:33 2010	(r16464)
@@ -9,3 +9,4 @@
 + bugfix/all/sata_via-Delay-on-vt6420-when-starting-ATAPI-DMA-write.patch
 + bugfix/all/r6040-fix-r6040_multicast_list.patch
 + bugfix/all/r6040-Fix-multicast-list-iteration.patch
++ bugfix/all/net-rds-remove-kmap_atomic-optimization.patch