Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-magellan/patches-2.6.25-r4/0112-2.6.25.13-all-fixes.patch

    Contents of /trunk/kernel26-magellan/patches-2.6.25-r4/0112-2.6.25.13-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 666 - (show annotations) (download)
    Wed Jul 30 14:06:20 2008 UTC (15 years, 9 months ago) by niro
    File size: 7546 byte(s) 
    -added more security fixes and kernel updates (up to 2.6.25.13)
    1 diff --git a/Documentation/networking/udplite.txt b/Documentation/networking/udplite.txt
    2 index 3870f28..855d8da 100644
    3 --- a/Documentation/networking/udplite.txt
    4 +++ b/Documentation/networking/udplite.txt
    5 @@ -148,7 +148,7 @@
    6 getsockopt(sockfd, SOL_SOCKET, SO_NO_CHECK, &value, ...);
    7
    8 is meaningless (as in TCP). Packets with a zero checksum field are
    9 - illegal (cf. RFC 3828, sec. 3.1) will be silently discarded.
    10 + illegal (cf. RFC 3828, sec. 3.1) and will be silently discarded.
    11
    12 4) Fragmentation
    13
    14 diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
    15 index ae9629f..c258a05 100644
    16 --- a/drivers/net/hamradio/hdlcdrv.c
    17 +++ b/drivers/net/hamradio/hdlcdrv.c
    18 @@ -88,6 +88,7 @@
    19 static inline void append_crc_ccitt(unsigned char *buffer, int len)
    20 {
    21 unsigned int crc = crc_ccitt(0xffff, buffer, len) ^ 0xffff;
    22 + buffer += len;
    23 *buffer++ = crc;
    24 *buffer++ = crc >> 8;
    25 }
    26 diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
    27 index ac0ac98..6bc58dd 100644
    28 --- a/drivers/net/pppoe.c
    29 +++ b/drivers/net/pppoe.c
    30 @@ -341,12 +341,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
    31 struct pppox_sock *relay_po;
    32
    33 if (sk->sk_state & PPPOX_BOUND) {
    34 - struct pppoe_hdr *ph = pppoe_hdr(skb);
    35 - int len = ntohs(ph->length);
    36 - skb_pull_rcsum(skb, sizeof(struct pppoe_hdr));
    37 - if (pskb_trim_rcsum(skb, len))
    38 - goto abort_kfree;
    39 -
    40 ppp_input(&po->chan, skb);
    41 } else if (sk->sk_state & PPPOX_RELAY) {
    42 relay_po = get_item_by_addr(&po->pppoe_relay);
    43 @@ -357,7 +351,6 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
    44 if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0)
    45 goto abort_put;
    46
    47 - skb_pull(skb, sizeof(struct pppoe_hdr));
    48 if (!__pppoe_xmit(sk_pppox(relay_po), skb))
    49 goto abort_put;
    50 } else {
    51 @@ -388,6 +381,7 @@ static int pppoe_rcv(struct sk_buff *skb,
    52 {
    53 struct pppoe_hdr *ph;
    54 struct pppox_sock *po;
    55 + int len;
    56
    57 if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
    58 goto out;
    59 @@ -399,10 +393,21 @@ static int pppoe_rcv(struct sk_buff *skb,
    60 goto drop;
    61
    62 ph = pppoe_hdr(skb);
    63 + len = ntohs(ph->length);
    64 +
    65 + skb_pull_rcsum(skb, sizeof(*ph));
    66 + if (skb->len < len)
    67 + goto drop;
    68
    69 po = get_item(ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
    70 - if (po != NULL)
    71 - return sk_receive_skb(sk_pppox(po), skb, 0);
    72 + if (!po)
    73 + goto drop;
    74 +
    75 + if (pskb_trim_rcsum(skb, len))
    76 + goto drop;
    77 +
    78 + return sk_receive_skb(sk_pppox(po), skb, 0);
    79 +
    80 drop:
    81 kfree_skb(skb);
    82 out:
    83 @@ -427,12 +432,12 @@ static int pppoe_disc_rcv(struct sk_buff *skb,
    84 if (dev->nd_net != &init_net)
    85 goto abort;
    86
    87 - if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
    88 - goto abort;
    89 -
    90 if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
    91 goto out;
    92
    93 + if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
    94 + goto abort;
    95 +
    96 ph = pppoe_hdr(skb);
    97 if (ph->code != PADT_CODE)
    98 goto abort;
    99 @@ -937,12 +942,10 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
    100 m->msg_namelen = 0;
    101
    102 if (skb) {
    103 - struct pppoe_hdr *ph = pppoe_hdr(skb);
    104 - const int len = ntohs(ph->length);
    105 -
    106 - error = memcpy_toiovec(m->msg_iov, (unsigned char *) &ph->tag[0], len);
    107 + total_len = min_t(size_t, total_len, skb->len);
    108 + error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len);
    109 if (error == 0)
    110 - error = len;
    111 + error = total_len;
    112 }
    113
    114 kfree_skb(skb);
    115 diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
    116 index a629355..a3e1d22 100644
    117 --- a/drivers/net/pppol2tp.c
    118 +++ b/drivers/net/pppol2tp.c
    119 @@ -783,14 +783,18 @@ static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock,
    120 err = 0;
    121 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
    122 flags & MSG_DONTWAIT, &err);
    123 - if (skb) {
    124 - err = memcpy_toiovec(msg->msg_iov, (unsigned char *) skb->data,
    125 - skb->len);
    126 - if (err < 0)
    127 - goto do_skb_free;
    128 - err = skb->len;
    129 - }
    130 -do_skb_free:
    131 + if (!skb)
    132 + goto end;
    133 +
    134 + if (len > skb->len)
    135 + len = skb->len;
    136 + else if (len < skb->len)
    137 + msg->msg_flags |= MSG_TRUNC;
    138 +
    139 + err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len);
    140 + if (likely(err == 0))
    141 + err = len;
    142 +
    143 kfree_skb(skb);
    144 end:
    145 return err;
    146 diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
    147 index 134c8e5..2584306 100644
    148 --- a/include/linux/ipv6.h
    149 +++ b/include/linux/ipv6.h
    150 @@ -123,6 +123,7 @@ struct ipv6hdr {
    151 struct in6_addr daddr;
    152 };
    153
    154 +#ifdef __KERNEL__
    155 /*
    156 * This structure contains configuration options per IPv6 link.
    157 */
    158 @@ -162,6 +163,7 @@ struct ipv6_devconf {
    159 #endif
    160 void *sysctl;
    161 };
    162 +#endif
    163
    164 /* index values for the variables in ipv6_devconf */
    165 enum {
    166 diff --git a/include/linux/kernel.h b/include/linux/kernel.h
    167 index 2df44e7..6890264 100644
    168 --- a/include/linux/kernel.h
    169 +++ b/include/linux/kernel.h
    170 @@ -20,6 +20,7 @@
    171 extern const char linux_banner[];
    172 extern const char linux_proc_banner[];
    173
    174 +#define USHORT_MAX ((u16)(~0U))
    175 #define INT_MAX ((int)(~0U>>1))
    176 #define INT_MIN (-INT_MAX - 1)
    177 #define UINT_MAX (~0U)
    178 diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
    179 index a3002fe..37801ae 100644
    180 --- a/net/ipv4/raw.c
    181 +++ b/net/ipv4/raw.c
    182 @@ -936,7 +936,7 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
    183 srcp = inet->num;
    184
    185 seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
    186 - " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d",
    187 + " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
    188 i, src, srcp, dest, destp, sp->sk_state,
    189 atomic_read(&sp->sk_wmem_alloc),
    190 atomic_read(&sp->sk_rmem_alloc),
    191 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    192 index 1704c14..9703c87 100644
    193 --- a/net/ipv4/udp.c
    194 +++ b/net/ipv4/udp.c
    195 @@ -1325,6 +1325,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
    196 return -ENOPROTOOPT;
    197 if (val != 0 && val < 8) /* Illegal coverage: use default (8) */
    198 val = 8;
    199 + else if (val > USHORT_MAX)
    200 + val = USHORT_MAX;
    201 up->pcslen = val;
    202 up->pcflag |= UDPLITE_SEND_CC;
    203 break;
    204 @@ -1337,6 +1339,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
    205 return -ENOPROTOOPT;
    206 if (val != 0 && val < 8) /* Avoid silly minimal values. */
    207 val = 8;
    208 + else if (val > USHORT_MAX)
    209 + val = USHORT_MAX;
    210 up->pcrlen = val;
    211 up->pcflag |= UDPLITE_RECV_CC;
    212 break;
    213 diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
    214 index 584e6d7..7135279 100644
    215 --- a/net/ipv4/xfrm4_mode_tunnel.c
    216 +++ b/net/ipv4/xfrm4_mode_tunnel.c
    217 @@ -52,7 +52,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
    218 IP_ECN_clear(top_iph);
    219
    220 top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
    221 - 0 : XFRM_MODE_SKB_CB(skb)->frag_off;
    222 + 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
    223 ip_select_ident(top_iph, dst->child, NULL);
    224
    225 top_iph->ttl = dst_metric(dst->child, RTAX_HOPLIMIT);
    226 diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
    227 index bab72b6..dee7fea 100644
    228 --- a/net/ipv6/ip6_fib.c
    229 +++ b/net/ipv6/ip6_fib.c
    230 @@ -679,7 +679,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
    231
    232 static __inline__ void fib6_start_gc(struct rt6_info *rt)
    233 {
    234 - if (ip6_fib_timer.expires == 0 &&
    235 + if (!timer_pending(&ip6_fib_timer) &&
    236 (rt->rt6i_flags & (RTF_EXPIRES|RTF_CACHE)))
    237 mod_timer(&ip6_fib_timer, jiffies +
    238 init_net.ipv6.sysctl.ip6_rt_gc_interval);
    239 @@ -687,7 +687,7 @@ static __inline__ void fib6_start_gc(struct rt6_info *rt)
    240
    241 void fib6_force_start_gc(void)
    242 {
    243 - if (ip6_fib_timer.expires == 0)
    244 + if (!timer_pending(&ip6_fib_timer))
    245 mod_timer(&ip6_fib_timer, jiffies +
    246 init_net.ipv6.sysctl.ip6_rt_gc_interval);
    247 }