OSDN Git Service
Jean Delvare [Fri, 31 Oct 2008 18:56:19 +0000 (19:56 +0100)]
i2c: Update comment of I2C_FUNC_SMBUS_*_I2C_BLOCK
Update the comment of I2C_FUNC_SMBUS_*_I2C_BLOCK, makes it in line
with the external i2c repository and the 2.6 kernel.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Jean Delvare [Fri, 31 Oct 2008 18:53:57 +0000 (19:53 +0100)]
i2c: The i2c mailing list is moving
Replace all references (actually, just one) to the old i2c mailing
list.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Willy Tarreau [Sun, 19 Oct 2008 21:23:03 +0000 (23:23 +0200)]
Change VERSION to 2.4.36.8
- security: avoid calling a NULL function pointer in drivers/video/tvaudio.c
- doc: mention chain-compiling for really old gccs
- CVE-2008-3275 Linux kernel local filesystem DoS
- Remove suid/sgid bits on truncate() (CVE-2008-4210)
- tcp: Clear probes_out more aggressively in tcp_ack().
- x86 would not build without CONFIG_VT
- pc_keyb: fix breakage on ia64/mips/mips64
- doc: fix examples and add suggestions about depmod
- netfilter: ip6t_{hbh,dst}: Rejects not-strict mode on rule insertion
Signed-off-by: Willy Tarreau <w@1wt.eu>
Arjan van de Ven [Sat, 11 Oct 2008 04:16:12 +0000 (21:16 -0700)]
security: avoid calling a NULL function pointer in drivers/video/tvaudio.c
NULL function pointers are very bad security wise. This one got caught by
kerneloops.org quite a few times, so it's happening in the field....
Fix is simple, check the function pointer for NULL, like 6 other places
in the same function are already doing.
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
[2.6 commit:
5ba2f67afb02c5302b2898949ed6fc3b3d37dcf1]
Signed-off-by: Willy Tarreau <w@1wt.eu>
Eugene Teo [Tue, 7 Oct 2008 01:45:11 +0000 (09:45 +0800)]
Remove suid/sgid bits on truncate() (CVE-2008-4210)
Hi Willy,
I noticed that CVE-2008-4210 is missing from the linux-2.4.git tree.
Don (cc'ed) proposed this:
Cc: Don Howard <dhoward@redhat.com>
Test-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Eugene Teo [Tue, 14 Oct 2008 07:04:08 +0000 (15:04 +0800)]
CVE-2008-3275 Linux kernel local filesystem DoS
This is a backport for CVE-2008-3275.
"Lookup can install a child dentry for a deleted directory. This keeps
the directory dentry alive, and the inode pinned in the cache and on
disk, even after all external references have gone away.
This isn't a big problem normally, since memory pressure or umount
will clear out the directory dentry and its children, releasing the
inode. But for UBIFS this causes problems because its orphan area can
overflow.
Fix this by returning ENOENT for all lookups on a S_DEAD directory
before creating a child dentry."
Signed-off-by: Eugene Teo <eugeneteo@kernel.sg>
[ WT: problem and fix confirmed on ramfs using method described
at http://lkml.org/lkml/2008/7/2/83 ]
Signed-off-by: Willy Tarreau <w@1wt.eu>
Yasuyuki KOZAKAI [Mon, 8 Sep 2008 06:32:34 +0000 (15:32 +0900)]
netfilter: ip6t_{hbh,dst}: Rejects not-strict mode on rule insertion
[2.6 commit:
8ca31ce52a5cfd03b960fd81a49197ae85d25347]
The current code ignores rules for internal options in HBH/DST options
header in packet processing if 'Not strict' mode is specified (which is not
implemented). Clearly it is not expected by user.
Kernel should reject HBH/DST rule insertion with 'Not strict' mode
in the first place.
Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Gilles Espinasse [Sat, 13 Sep 2008 17:49:12 +0000 (19:49 +0200)]
tcp: Clear probes_out more aggressively in tcp_ack().
backport of 2.6 commit
4b53fb67e385b856a991d402096379dab462170a
Test conditions : 2.4.36 kernel using this iptables configuration
iptables -N SLOWLO
iptables -A SLOWLO -m limit --limit 2/sec --limit-burst 1 -j ACCEPT
iptables -A SLOWLO -j DROP
iptables -A OUTPUT -o lo -p tcp --dport 12000 -j SLOWLO
borrowed ss from iproute2-2.4.7-now-ss020116-try.tar.gz,
I had the same result on 2.4.36.7 as Eric Dumazet on 2.6.25 without the patch with his test program.
---- From David S. Miller commit log message
This is based upon an excellent bug report from Eric Dumazet.
tcp_ack() should clear ->icsk_probes_out even if there are packets
outstanding. Otherwise if we get a sequence of ACKs while we do have
packets outstanding over and over again, we'll never clear the
probes_out value and eventually think the connection is too sick and
we'll reset it.
This appears to be some "optimization" added to tcp_ack() in the 2.4.x
timeframe. In 2.2.x, probes_out is pretty much always cleared by
tcp_ack().
Here is Eric's original report:
----------------------------------------
Apparently, we can in some situations reset TCP connections in a couple of seconds when some frames are lost.
In order to reproduce the problem, please try the following program on linux-2.6.25.*
Setup some iptables rules to allow two frames per second sent on loopback interface to tcp destination port 12000
...
Then run the attached program and see the output :
./test_tcp-input
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 40 127.0.0.1:32769 127.0.0.1:12000 timer:(persist,180ms,1)
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 40 127.0.0.1:32769 127.0.0.1:12000 timer:(persist,180ms,3)
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 40 127.0.0.1:32769 127.0.0.1:12000 timer:(persist,180ms,5)
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 40 127.0.0.1:32769 127.0.0.1:12000 timer:(persist,180ms,7)
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 40 127.0.0.1:32769 127.0.0.1:12000 timer:(persist,180ms,9)
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 40 127.0.0.1:32769 127.0.0.1:12000 timer:(persist,180ms,11)
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 40 127.0.0.1:32769 127.0.0.1:12000 timer:(persist,180ms,13)
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 40 127.0.0.1:32769 127.0.0.1:12000 timer:(persist,180ms,15)
write(): Connection timed out
wrote 880 bytes but was interrupted after 10 seconds
ESTAB 0 0 127.0.0.1:12000 127.0.0.1:32769
Exiting read() because no data available (4000 ms timeout).
read 860 bytes
While this tcp session makes progress (sending frames with 50 bytes of payload, every 500ms), linux tcp stack decides to reset it, when tcp_retries 2 is reached (default value : 15)
...
Source of program :
/*
* small producer/consumer program.
* setup a listener on 127.0.0.1:12000
* Forks a child
* child connect to 127.0.0.1, and sends 10 bytes on this tcp socket every 100 ms
* Father accepts connection, and read all data
*/
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <stdio.h>
#include <time.h>
#include <sys/poll.h>
int port = 12000;
char buffer[4096];
int main(int argc, char *argv[])
{
int lfd = socket(AF_INET, SOCK_STREAM, 0);
struct sockaddr_in socket_address;
time_t t0, t1;
int on = 1, sfd, res;
unsigned long total = 0;
socklen_t alen = sizeof(socket_address);
pid_t pid;
time(&t0);
socket_address.sin_family = AF_INET;
socket_address.sin_port = htons(port);
socket_address.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
if (lfd == -1) {
perror("socket()");
return 1;
}
setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(int));
if (bind(lfd, (struct sockaddr *)&socket_address, sizeof(socket_address)) == -1) {
perror("bind");
close(lfd);
return 1;
}
if (listen(lfd, 1) == -1) {
perror("listen()");
close(lfd);
return 1;
}
pid = fork();
if (pid == 0) {
int i, cfd = socket(AF_INET, SOCK_STREAM, 0);
close(lfd);
if (connect(cfd, (struct sockaddr *)&socket_address, sizeof(socket_address)) == -1) {
perror("connect()");
return 1;
}
for (i = 0 ; ;) {
res = write(cfd, "blablabla\n", 10);
if (res > 0) total += res;
else if (res == -1) {
perror("write()");
break;
} else break;
usleep(100000);
if (++i == 10) {
system("ss -on dst 127.0.0.1:12000");
i = 0;
}
}
time(&t1);
fprintf(stderr, "wrote %lu bytes but was interrupted after %g seconds\n", total, difftime(t1, t0));
system("ss -on | grep 127.0.0.1:12000");
close(cfd);
return 0;
}
sfd = accept(lfd, (struct sockaddr *)&socket_address, &alen);
if (sfd == -1) {
perror("accept");
return 1;
}
close(lfd);
while (1) {
struct pollfd pfd[1];
pfd[0].fd = sfd;
pfd[0].events = POLLIN;
if (poll(pfd, 1, 4000) == 0) {
fprintf(stderr, "Exiting read() because no data available (4000 ms timeout).\n");
break;
}
res = read(sfd, buffer, sizeof(buffer));
if (res > 0) total += res;
else if (res == 0) break;
else perror("read()");
}
fprintf(stderr, "read %lu bytes\n", total);
close(sfd);
return 0;
}
----------------------------------------
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Gilles Espinasse g.esp@free.fr
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 21 Sep 2008 21:18:32 +0000 (23:18 +0200)]
doc: fix examples and add suggestions about depmod
Grant Coady has reported these useful suggestions and workaround
for possible build errors related to building a new compiler.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Erik Inge Bolsø [Fri, 12 Sep 2008 18:45:21 +0000 (20:45 +0200)]
doc: mention chain-compiling for really old gccs
Compiling gcc 2.95.3 directly with 4.x breaks. Mention
chain-compiling as a way to get around that, and end
up with as ancient a gcc as you might like.
Signed-off-by: Erik Inge Bolsø <knan-lkml@anduin.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 7 Sep 2008 15:54:31 +0000 (17:54 +0200)]
pc_keyb: fix breakage on ia64/mips/mips64
Commit
f8db8c9c81afb4b04c146cae0e2a1fd311de1f22 fixed the keyboard
controller jammed issue on keyboard-less PCs, but introduced the
problem for other architectures (ia64/mips/mips64) which already
define their own keyboard probing method.
This patch gives precedence to these archs' probing method and only
defines the setup option if no arch-specific method was defined.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 7 Sep 2008 10:37:51 +0000 (12:37 +0200)]
x86 would not build without CONFIG_VT
I've been using this patch for a while without noticing it never
went into mainline. It is required to build i386 without CONFIG_VT.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 7 Sep 2008 09:32:13 +0000 (11:32 +0200)]
Change VERSION to 2.4.36.7
- sctp: Make sure N * sizeof(union sctp_addr) does not overflow (CVE-2008-2826)
- wan: Missing capability checks in sbni_ioctl() (CVE-2008-3525)
- [PPPOE]: Missing result check in __pppoe_xmit().
- udf: fix uid/gid permissions
- net pppoe: Check packet length on all receive paths
- ipv6: use timer pending
- sctp: Do not leak memory on multiple listen() calls
- sctp: Allow only 1 listening socket with SO_REUSEADDR
- doc: explain how to build a suitable gcc in Documentation/using-newer-gcc.txt
- sound: fix warning due to incorrect error code checking in ad1889
- sky2: fix uninitialized "mss" variable in sky2_xmit_frame()
- Correct the upto value during list conntrack information
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 7 Sep 2008 08:45:38 +0000 (10:45 +0200)]
sky2: fix uninitialized "mss" variable in sky2_xmit_frame()
This variable was initialized within the #if NETIF_F_TSO block
which is not used on kernel 2.4. This has probably caused a
bunch of unstability. This driver would need a new backport
anyway.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 7 Sep 2008 08:16:29 +0000 (10:16 +0200)]
sound: fix warning due to incorrect error code checking in ad1889
ad1889.c: In function `ad1889_ac97_init':
ad1889.c:857: warning: comparison is always false due to limited range of data type
This is caused by a short being compared against 0xFFFFFF while
0xFFFF was indeed expected. The missing device would just never
have been detected.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sat, 6 Sep 2008 21:14:31 +0000 (23:14 +0200)]
doc: explain how to build a suitable gcc in Documentation/using-newer-gcc.txt
Since many people are using recent distros which do not ship a compatible
gcc anymore, here's a procedure explaining in details how to build an older
gcc to build kernel 2.4.
Signed-off-by: Willy Tarreau <w@1wt.eu>
David S. Miller [Sat, 21 Jun 2008 05:04:34 +0000 (22:04 -0700)]
sctp: Make sure N * sizeof(union sctp_addr) does not overflow (CVE-2008-2826)
[backport of 2.6 commit
735ce972fbc8a65fb17788debd7bbe7b4383cc62]
As noticed by Gabriel Campana, the kmalloc() length arg
passed in by sctp_getsockopt_local_addrs_old() can overflow
if ->addr_num is large enough.
Therefore, enforce an appropriate limit.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Vlad Yasevich [Sat, 19 Jul 2008 06:06:32 +0000 (23:06 -0700)]
sctp: Allow only 1 listening socket with SO_REUSEADDR
[backport of 2.6 commit
4e54064e0a13b7a7d4a481123c1783f770538e30]
When multiple socket bind to the same port with SO_REUSEADDR,
only 1 can be listining.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Vlad Yasevich [Sat, 19 Jul 2008 06:06:07 +0000 (23:06 -0700)]
sctp: Do not leak memory on multiple listen() calls
[backport of 2.6 commit
23b29ed80bd7184398317a111dc488605cb66c7f]
SCTP permits multiple listen call and on subsequent calls
we leak he memory allocated for the crypto transforms.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Gilbert Ashley Gilbert [Sat, 6 Sep 2008 08:20:00 +0000 (10:20 +0200)]
udf: fix uid/gid permissions
This change made it into the 2.6 branch since 2.6.15 and fixes a problem
where the UDF code would change the ownership of files in a UDF filesystem
when they were different thatn the current user, when possible. Example: after
creating a CD using udf as a regular user, if you mounted the CD as root, the
udf code would reset the ownership of all the files on the cd, causing
unecessary write operations. I found this fix while working with an old patch
which adds packet-writing to the 2.4 kernel. This fix is from the original
author (or maintainer) of the udf code.
Note: this was fixed upstream in
4d6660eb3665f22d16aff466eb9d45df6102b254.
Eugene Teo [Wed, 27 Aug 2008 11:50:30 +0000 (04:50 -0700)]
wan: Missing capability checks in sbni_ioctl() (CVE-2008-3525)
[backport of 2.6 commit
f2455eb176ac87081bbfc9a44b21c7cd2bc1967e]
There are missing capability checks in the following code:
1300 static int
1301 sbni_ioctl( struct net_device *dev, struct ifreq *ifr, int cmd)
1302 {
[...]
1319 case SIOCDEVRESINSTATS :
1320 if( current->euid != 0 ) /* root only */
1321 return -EPERM;
[...]
1336 case SIOCDEVSHWSTATE :
1337 if( current->euid != 0 ) /* root only */
1338 return -EPERM;
[...]
1357 case SIOCDEVENSLAVE :
1358 if( current->euid != 0 ) /* root only */
1359 return -EPERM;
[...]
1372 case SIOCDEVEMANSIPATE :
1373 if( current->euid != 0 ) /* root only */
1374 return -EPERM;
Here's my proposed fix:
Missing capability checks.
Signed-off-by: Eugene Teo <eugeneteo@kernel.sg>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Florin Malita [Mon, 5 Jun 2006 22:34:33 +0000 (15:34 -0700)]
[PPPOE]: Missing result check in __pppoe_xmit().
[backport of 2.6 commit
9bc18091a5e44a368827f539289b99788eb27d4e]
skb_clone() may fail, we should check the result.
Coverity CID: 1215.
Signed-off-by: Florin Malita <fmalita@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Herbert Xu [Tue, 10 Jun 2008 21:07:25 +0000 (14:07 -0700)]
net pppoe: Check packet length on all receive paths
[backport of 2.6 commit
392fdb0e35055b96faa9c1cd6ab537805337cdce]
The length field in the PPPOE header wasn't checked completely.
This patch causes all packets shorter than the declared length
to be dropped.
It also changes the memcpy_toiovec call to skb_copy_datagram_iovec
so that paged packets (rare for PPPOE) are handled properly.
Thanks to Ilja of the Netric Security Team for discovering and
reporting this bug, and Chris Wright for the total_len check.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Stephen Hemminger [Mon, 21 Jul 2008 20:21:35 +0000 (13:21 -0700)]
ipv6: use timer pending
[backport of 2.6 commit
847499ce71bdcc8fc542062df6ebed3e596608dd]
This fixes the bridge reference count problem and cleanups ipv6 FIB
timer management. Don't use expires field, because it is not a proper
way to test, instead use timer_pending().
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Xiong Wu [Fri, 4 Jul 2008 11:21:15 +0000 (13:21 +0200)]
Correct the upto value during list conntrack information
The problem:
When list numerous conntrack information from /proc/net/ip_conntrack,
we found some items are missing.
The solution:
This patch correct the upto value in conntrack_iterate() when the length
of conntrack information exceed the max length.
Cc: Patrick McHardy <kaber@trash.net>
Cc: coreteam@netfilter.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Fri, 6 Jun 2008 16:24:19 +0000 (18:24 +0200)]
Change VERSION to 2.4.36.6
- asn1: additional sanity checking during BER decoding (CVE-2008-1673)
Signed-off-by: Willy Tarreau <w@1wt.eu>
Chris Wright [Wed, 4 Jun 2008 16:16:33 +0000 (09:16 -0700)]
asn1: additional sanity checking during BER decoding (CVE-2008-1673)
[backport of 2.6 commit
ddb2c43594f22843e9f3153da151deaba1a834c5]
- Don't trust a length which is greater than the working buffer.
An invalid length could cause overflow when calculating buffer size
for decoding oid.
- An oid length of zero is invalid and allows for an off-by-one error when
decoding oid because the first subid actually encodes first 2 subids.
- A primitive encoding may not have an indefinite length.
Thanks to Wei Wang from McAfee for report.
Cc: Steven French <sfrench@us.ibm.com>
Cc: stable@kernel.org
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[w@1wt.eu: backported to 2.4 : no cifs ; snmp in ip_nat_snmp_basic.c]
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 1 Jun 2008 18:32:42 +0000 (20:32 +0200)]
Change VERSION to 2.4.36.5
- sit: Add missing kfree_skb() on pskb_may_pull() failure (CVE-2008-2136)
- sparc: Fix mmap VA span checking (CVE-2008-2137)
- 3c980-TX needs EXTRA_PREAMBLE
- ACPI: check a return value correctly in acpi_power_get_context()
- wireless, airo: waitbusy() won't delay
- signal.h: use an explicit cast to silent compiler warnings
- fix build error with some flavours of gcc 2.95.3
- old buffer overflow in moxa driver (CVE-2005-0504)
Signed-off-by: Willy Tarreau <w@1wt.eu>
David S. Miller [Sun, 1 Jun 2008 16:12:00 +0000 (18:12 +0200)]
sparc: Fix mmap VA span checking (CVE-2008-2137)
[backport of 2.6 commit
5816339310b2d9623cf413d33e538b45e815da5d]
We should not conditionalize VA range checks on MAP_FIXED.
Signed-off-by: David S. Miller <davem@davemloft.net>
[w@1wt.eu: sparc_mmap_check() does not exist in 2.4]
Signed-off-by: Willy Tarreau <w@1wt.eu>
Li Zefan [Fri, 18 Apr 2008 20:27:29 +0000 (13:27 -0700)]
ACPI: check a return value correctly in acpi_power_get_context()
[backport of 2.6 commit
a815ab8b5891f3d2515316655729272f68269e3b]
We should check *resource != NULL rather than resource != NULL, which will be
always true.
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Zhao Yakui <yakui.zhao@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Roel Kluin [Tue, 13 May 2008 20:12:27 +0000 (22:12 +0200)]
wireless, airo: waitbusy() won't delay
[backport of 2.6 commit
b7acbdfbd1f277c1eb23f344f899cfa4cd0bf36a]
There will be no delay even when COMMAND_BUSY (defined 0x8000) is set:
0x8000 & (delay < 10000) will evaluate to 0 - when delay is 0.
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Steve Rosenbluth [Sun, 1 Jun 2008 14:35:54 +0000 (16:35 +0200)]
fix build error with some flavours of gcc 2.95.3
This patches include/asm/processor.h
Sometime between 2.4.29 and 2.4.36.2 spaces were deleted between colons
which causes compiler gcc 2.95.3 to fail to parse the header
when compiling applications which include it.
Adding back the spaces solves the problem on gcc 2.95.3.
gcc 4.1.1 also compiles the kernel OK with this patch."
Signed-off-by: Willy Tarreau <w@1wt.eu>
Steve Rosenbluth [Sun, 1 Jun 2008 14:33:00 +0000 (16:33 +0200)]
signal.h: use an explicit cast to silent compiler warnings
This patches include/linux/signal.h
There is an implicit cast from an integer to an
unsigned long (sigset_t) which causes compilers to generate warnings.
Different compilers could possibly produce different code.
This change has been tested over several years of use and is stable.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Gunnar Larisch [Sat, 17 May 2008 15:06:49 +0000 (17:06 +0200)]
3c980-TX needs EXTRA_PREAMBLE
The ethernet card 3c980-TX needs a mdio_sync() to initialize the ethernet
properly. This is forced by adding an EXTRA_PREAMBLE to its drv_flags.
Without this, the driver did not reconnect after a link loss since
Version 2.4.29.
Signed-off-by: Gunnar Larisch <Gunnar.Larisch@gmx.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
David S. Miller [Fri, 9 May 2008 06:40:26 +0000 (23:40 -0700)]
sit: Add missing kfree_skb() on pskb_may_pull() failure (CVE-2008-2136)
[backport of 2.6 commit
36ca34cc3b8335eb1fe8bd9a1d0a2592980c3f02]
Noticed by Paul Marks <paul@pmarks.net>.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
dann frazier [Tue, 8 May 2007 07:31:39 +0000 (00:31 -0700)]
old buffer overflow in moxa driver (CVE-2005-0504)
[backport of 2.6 commit
a2f72982e22b96862f8f15272732bd316d4db040]
old buffer overflow in moxa driver
I noticed that the moxa input checking security bug described by
CVE-2005-0504 appears to remain unfixed upstream.
The issue is described here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0504
Debian has been shipping the following patch from Andres Salomon.
(akpm: it's a privileged operation)
Signed-off-by: dann frazier <dannf@hp.com>
Signed-off-by: Andres Salomon <dilinger@debian.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Tue, 6 May 2008 23:00:29 +0000 (01:00 +0200)]
Change VERSION to 2.4.36.4
- Fix SMP ordering hole in fcntl_setlk() (CVE-2008-1669)
- Fix dnotify/close race (CVE-2008-1375)
Al Viro [Tue, 6 May 2008 22:16:24 +0000 (00:16 +0200)]
Fix SMP ordering hole in fcntl_setlk() (CVE-2008-1669)
[ sync up with 2.6 commit
0b2bac2f1ea0d33a3621b27ca68b9ae760fca2e9 ]
fcntl_setlk()/close() race prevention has a subtle hole - we need to
make sure that if we *do* have an fcntl/close race on SMP box, the
access to descriptor table and inode->i_flock won't get reordered.
As it is, we get STORE inode->i_flock, LOAD descriptor table entry vs.
STORE descriptor table entry, LOAD inode->i_flock with not a single
lock in common on both sides. We do have BKL around the first STORE,
but check in locks_remove_posix() is outside of BKL and for a good
reason - we don't want BKL on common path of close(2).
Solution is to hold ->file_lock around fcheck() in there; that orders
us wrt removal from descriptor table that preceded locks_remove_posix()
on close path and we either come first (in which case eviction will be
handled by the close side) or we'll see the effect of close and do
eviction ourselves. Note that even though it's read-only access,
we do need ->file_lock here - rcu_read_lock() won't be enough to
order the things.
[ w@1wt.eu: this patch also includes a missing fix for and older
bug affecting the same code, which was already fixed in 2.6. As
of now, 2.4 is in sync with 2.6 concerning this bug. ]
Willy Tarreau [Sat, 5 Apr 2008 13:31:59 +0000 (15:31 +0200)]
Fix dnotify/close race (CVE-2008-1375)
Issue reported by Al Viro with description taken from 2.6 commit
214b7049a7929f03bbd2786aaef04b8b79db34e2 :
We have a race between fcntl() and close() that can lead to
dnotify_struct inserted into inode's list *after* the last descriptor
had been gone from current->files.
Since that's the only point where dnotify_struct gets evicted, we are
screwed - it will stick around indefinitely. Even after struct file in
question is gone and freed. Worse, we can trigger send_sigio() on it at
any later point, which allows to send an arbitrary signal to arbitrary
process if we manage to apply enough memory pressure to get the page
that used to host that struct file and fill it with the right pattern...
Willy Tarreau [Sat, 19 Apr 2008 14:39:27 +0000 (16:39 +0200)]
Change VERSION to 2.4.36.3
- usb-serial: back-port of pl2303.c from 2.6.24.1
- ext2_readdir() filp->f_pos fix (try #2)
- Duplicate id in videodev.h
- Fix typo in acpi_boot_init
- ip-pnp-dhcp: wait lazily when doing dhcp for diskless systems
- [TCP]: Fix shrinking windows with window scaling
- intermezzo: fix uninitialized use of pointer in error path
Willy Tarreau [Fri, 18 Apr 2008 10:01:15 +0000 (12:01 +0200)]
intermezzo: fix uninitialized use of pointer in error path
gcc pointed out the following issue :
dcache.c: In function `presto_set_dd':
dcache.c:251: warning: `fset' might be used uninitialized in this function
fset is not yet assigned in the error path, so no operation must be done
with it.
Patrick McHardy [Thu, 20 Mar 2008 23:11:27 +0000 (16:11 -0700)]
[TCP]: Fix shrinking windows with window scaling
[backported from 2.6 commit
607bfbf2d55dd1cfe5368b41c2a81a8c9ccf4723]
When selecting a new window, tcp_select_window() tries not to shrink
the offered window by using the maximum of the remaining offered window
size and the newly calculated window size. The newly calculated window
size is always a multiple of the window scaling factor, the remaining
window size however might not be since it depends on rcv_wup/rcv_nxt.
This means we're effectively shrinking the window when scaling it down.
The dump below shows the problem (scaling factor 2^7):
- Window size of 557 (71296) is advertised, up to
3111907257:
IP 172.2.2.3.33000 > 172.2.2.2.33000: . ack
3111835961 win 557 <...>
- New window size of 514 (65792) is advertised, up to
3111907217, 40 bytes
below the last end:
IP 172.2.2.3.33000 > 172.2.2.2.33000: .
3113575668:
3113577116(1448) ack
3111841425 win 514 <...>
The number 40 results from downscaling the remaining window:
3111907257 -
3111841425 = 65832
65832 / 2^7 = 514
65832 % 2^7 = 40
If the sender uses up the entire window before it is shrunk, this can have
chaotic effects on the connection. When sending ACKs, tcp_acceptable_seq()
will notice that the window has been shrunk since tcp_wnd_end() is before
tp->snd_nxt, which makes it choose tcp_wnd_end() as sequence number.
This will fail the receivers checks in tcp_sequence() however since it
is before it's tp->rcv_wup, making it respond with a dupack.
If both sides are in this condition, this leads to a constant flood of
ACKs until the connection times out.
Make sure the window is never shrunk by aligning the remaining window to
the window scaling factor.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Jesse Brandeburg [Wed, 16 Apr 2008 01:15:10 +0000 (18:15 -0700)]
[PATCH] ip-pnp-dhcp: wait lazily when doing dhcp for diskless systems
ic_dynamic() holds the cpu too long and tasks do not have a chance to run.
This causes adapters like e1000 that have the link come up in a tasklet to fail
link up due to exceptionally long delays in acquiring link, and then a dhcp
address.
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
David Newall [Wed, 16 Apr 2008 08:26:15 +0000 (10:26 +0200)]
usb-serial: back-port of pl2303.c from 2.6.24.1
I experienced major major data loss on a PL-2303 USB-serial converter
under 2.4.36, which I remedied by back-porting the pl2303.c from the
latest 2.6 kernel tree.
Here's a new patch, which is more complete than my previous one.
It's based on the 2.6.24.1.
There's a lot of trivial white-space changes and some things that have
been moved, which make the patch rather larger than it could be. I
didn't include those changes before, but have now in order that the
driver be closer to the 2.6 driver. It'll never be identical, of course.
Note, too, that the 2.6 driver (and thus the patched 2.4) includes a 1k
circular buffer which rather duplicates a buffer in the 2.4 usbserial.c;
2.6's usb-serial has had that buffer removed. As the buffer resolves
loss of the occasional putchar (e.g. from n_tty's opost), it is
important and correct, even in 2.4.
Speaking as a user, I no longer see any problems with PL2303, and I
think this is okay to release.
Cc: Greg Kroah-Hartman <greg@kroah.com>
Glen Nakamura [Wed, 16 Apr 2008 08:13:15 +0000 (10:13 +0200)]
Fix typo in acpi_boot_init
Here's a heads up on a couple of patches I submitted a few years back
that seem to have been forgotten:
http://marc.info/?l=linux-kernel&m=
111467256405878&w=2
The following ChangeSet introduced a typo in acpi_boot_init:
ChangeSet@1.1448.1.123 2005-03-09 11:43:51-03:00 marcelo@cnet
* Early ACPI PCI quirk depends on CONFIG_X86_IO_APIC
CONFIG_X86_IOAPIC should obviously be CONFIG_X86_IO_APIC
as written in the patch description above.
Trivial fix below.
Signed-off-by: Glen Nakamura <glen@imodulo.com>
Glen Nakamura [Wed, 16 Apr 2008 08:09:45 +0000 (10:09 +0200)]
Duplicate id in videodev.h
Here's a heads up on a couple of patches I submitted a few years back
that seem to have been forgotten:
http://marc.info/?l=linux-kernel&m=
111467271031451&w=2
VID_HARDWARE_W9968CF and VID_HARDWARE_SAA7114H are both assigned value 36.
Trivial patch below increases VID_HARDWARE_SAA7114H to 37.
Signed-off-by: Glen Nakamura <glen@imodulo.com>
Glen Nakamura [Wed, 16 Apr 2008 08:06:58 +0000 (10:06 +0200)]
ext2_readdir() filp->f_pos fix (try #2)
This patch reintroduces a fixed version of reverted commit
c30306fb287323591c854a0982d9fa5351859b45 from Dann Frazier :
This is a 2.4 backport of a linux-2.6 change by Jan Blunck
(old-2.6-bkcvs commit
2196b4744393d4f6c06fc4d63b98556d05b90933)
Commit log from 2.6 follows.
[PATCH] ext2_readdir() filp->f_pos fix
If the whole directory is read, ext2_readdir() sets the f_pos to a multiple
of the page size (because of the conditions of the outer for loop). This
sets the wrong f_pos for directory inodes on ext2 partitions with a block
size differing from the page size.
Note from Glen :
Perhaps the "filp->f_pos += le16_to_cpu(de->rec_len);" line should be
outside of the if statement like the indentation implies?
As it is, filp->f_pos gets corrupted if de->inode is ever zero...
This could possibly explain why I had a few strange directory
entries until I checked the filesystem with:
e2fsck -D -F -f /dev/{ext2 partition}
This fix was confirmed by both Dann Frazier and Pascal Hambourg.
Note from Willy :
The code now differs from 2.6 only by commit
2d7f2ea9c989853310c7f6e8be52cc090cc8e66b which is only in 2.6.
The reporter, Al Masoud, provided the test case which could not be
reproduced on 2.4 (neither with nor without the fix above), so the
patch in question has *not* been applied to 2.4.
Dann will take the same approach for the Debian update.
Willy Tarreau [Sun, 24 Feb 2008 20:38:03 +0000 (21:38 +0100)]
Change VERSION to 2.4.36.2
- Revert "ext2_readdir() filp->f_pos fix"
- 2.4: [POWERPC] CHRP: Fix possible NULL pointer dereference
Willy Tarreau [Sun, 24 Feb 2008 20:26:45 +0000 (21:26 +0100)]
Revert "ext2_readdir() filp->f_pos fix"
This reverts commit
c30306fb287323591c854a0982d9fa5351859b45.
This backported fix caused some lockups to people while reading
directories.
Cc: dann frazier <dannf@hp.com>
dann frazier [Fri, 22 Feb 2008 22:46:45 +0000 (15:46 -0700)]
2.4: [POWERPC] CHRP: Fix possible NULL pointer dereference
This is a 2.4 backport of a linux-2.6 change by Cyrill Gorcunov.
(commit
9ac71d00398674aaec664f30559f0a21d963862f)
CVE-2007-6694 was assigned for this issue.
This backport has been compile-tested only.
Commit log from 2.6 follows.
This fixes a possible NULL pointer dereference inside of strncmp() if
of_get_property() fails.
Signed-off-by: dann frazier <dannf@hp.com>
Willy Tarreau [Sat, 16 Feb 2008 12:56:03 +0000 (13:56 +0100)]
Change VERSION to 2.4.36.1
- Do not complain about gcc 4.2 for user-space
- i386: fix setCx86/getCx86 race in macros
- security: insufficient range checks in certain fault handlers
- ext2_readdir() filp->f_pos fix
- avoid semi-infinite loop when mounting bad ext2
- ext2: skip pages past number of blocks in ext2_find_entry
- memory leak when socket is release()d before PPPIOCGCHAN has been called on it
- 2.4: fix memory corruption from misinterpreted bad_inode_ops return values
- 2.4: [SCSI] aacraid: Fix security hole
- 2.4: USB: fix DoS in pwc USB video driver
Willy Tarreau [Sun, 3 Feb 2008 17:32:33 +0000 (18:32 +0100)]
security: insufficient range checks in certain fault handlers
This is the 2.4 version of Nick Piggin's work on 2.6 fault handlers.
This deals with security vulnerability CVE-2008-0007.
Drivers that register a ->nopage handler, that does not range-check its
offset argument, must set VM_DONTEXPAND in the vm_flags to ensure the
offset is within bounds.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 10 Feb 2008 21:52:35 +0000 (22:52 +0100)]
i386: fix setCx86/getCx86 race in macros
Because of the way the setCx86 macro is defined, a call to
setCx86(XXXX, getCx86(XXXX)) will produce the wrong output sequence.
This affects at least one place in arch/i386/kernel/setup.c :
/* Enable MMX extensions (App note 108) */
setCx86(CX86_CCR7, getCx86(CX86_CCR7)|1);
A correct solution consists in passing the value argument via a
temporary variable. 2.6 has a different fix using inline functions,
which produce equivalent code though.
Signed-off-by: Willy Tarreau <w@1wt.eu>
dann frazier [Thu, 7 Feb 2008 02:06:18 +0000 (19:06 -0700)]
2.4: USB: fix DoS in pwc USB video driver
This is a 2.4 backport of a linux-2.6 change by Oliver Neukum.
(commit
85237f202d46d55c1bffe0c5b1aa3ddc0f1dce4d)
CVE-2007-5093 was assigned for this issue.
This backport has been compile-tested only.
Commit log from 2.6 follows.
the pwc driver has a disconnect method that waits for user space to
close the device. This opens up an opportunity for a DoS attack,
blocking the USB subsystem and making khubd's task busy wait in
kernel space. This patch shifts freeing resources to close if an opened
device is disconnected.
Signed-off-by: dann frazier <dannf@hp.com>
dann frazier [Tue, 5 Feb 2008 10:33:28 +0000 (03:33 -0700)]
2.4: [SCSI] aacraid: Fix security hole
This is a 2.4 backport of a linux-2.6 change by Alan Cox.
(commit
60395bb60e0b5e4e0808ac8eb07a92f6c9cdea1f)
It has been build-tested only (I don't have the hardware).
CVE-2007-4308 was assigned for this issue.
Commit log from 2.6 follows.
On the SCSI layer ioctl path there is no implicit permissions check for
ioctls (and indeed other drivers implement unprivileged ioctls). aacraid
however allows all sorts of very admin only things to be done so should
check.
dann frazier [Thu, 24 Jan 2008 06:12:12 +0000 (23:12 -0700)]
2.4: fix memory corruption from misinterpreted bad_inode_ops return values
This is a 2.4 backport of a linux-2.6 change by Eric Sandeen
(commit
be6aab0e9fa6d3c6d75aa1e38ac972d8b4ee82b8)
CVE-2006-5753 was assigned for this issue.
I've built and boot-tested this, but I'm not sure how to exercise
these codepaths.
Commit log from 2.6 follows.
CVE-2006-5753 is for a case where an inode can be marked bad, switching
the ops to bad_inode_ops, which are all connected as:
static int return_EIO(void)
{
return -EIO;
}
#define EIO_ERROR ((void *) (return_EIO))
static struct inode_operations bad_inode_ops =
{
.create = bad_inode_create
...etc...
The problem here is that the void cast causes return types to not be
promoted, and for ops such as listxattr which expect more than 32 bits of
return value, the 32-bit -EIO is interpreted as a large positive 64-bit
number, i.e. 0x00000000fffffffa instead of 0xfffffffa.
This goes particularly badly when the return value is taken as a number of
bytes to copy into, say, a user's buffer for example...
I originally had coded up the fix by creating a return_EIO_<TYPE> macro
for each return type, like this:
static int return_EIO_int(void)
{
return -EIO;
}
#define EIO_ERROR_INT ((void *) (return_EIO_int))
static struct inode_operations bad_inode_ops =
{
.create = EIO_ERROR_INT,
...etc...
but Al felt that it was probably better to create an EIO-returner for each
actual op signature. Since so few ops share a signature, I just went ahead
& created an EIO function for each individual file & inode op that returns
a value.
Signed-off-by: dann frazier <dannf@hp.com>
dann frazier [Tue, 22 Jan 2008 06:10:51 +0000 (23:10 -0700)]
memory leak when socket is release()d before PPPIOCGCHAN has been called on it
This is a 2.4 backport of a linux-2.6 change by Florian Zumbiehl.
(commit
202a03acf9994076055df40ae093a5c5474ad0bd)
CVE-2007-2525 was assigned for this issue - compile-tested only.
Commit log from 2.6 follows.
below you find a patch that fixes a memory leak when a PPPoE socket is
release()d after it has been connect()ed, but before the PPPIOCGCHAN ioctl
ever has been called on it.
This is somewhat of a security problem, too, since PPPoE sockets can be
created by any user, so any user can easily allocate all the machine's
RAM to non-swappable address space and thus DoS the system.
Is there any specific reason for PPPoE sockets being available to any
unprivileged process, BTW? After all, you need a packet socket for the
discovery stage anyway, so it's unlikely that any unprivileged process
will ever need to create a PPPoE socket, no? Allocating all session IDs
for a known AC is a kind of DoS, too, after all - with Juniper ERXes,
this is really easy, actually, since they don't ever assign session ids
above 8000 ...
dann frazier [Tue, 22 Jan 2008 00:16:51 +0000 (17:16 -0700)]
ext2: skip pages past number of blocks in ext2_find_entry
This is a 2.4 backport of a linux-2.6 change by Eric Sandeen
(commit
d8adb9cef7e406a9a82881695097c702bc98422f)
CVE-2006-6054 was assigned for this issue, which is easily reproducible in 2.4.
However, this changeset alone does not resolve the issue for 2.4 - two earlier
backports for ext2_readdir() are required.
Commit log from 2.6 follows.
[PATCH] ext2: skip pages past number of blocks in ext2_find_entry
This one was pointed out on the MOKB site:
http://kernelfun.blogspot.com/2006/11/mokb-09-11-2006-linux-26x-ext2checkpage.html
If a directory's i_size is corrupted, ext2_find_entry() will keep
processing pages until the i_size is reached, even if there are no more
blocks associated with the directory inode. This patch puts in some
minimal sanity-checking so that we don't keep checking pages (and issuing
errors) if we know there can be no more data to read, based on the block
count of the directory inode.
This is somewhat similar in approach to the ext3 patch I sent earlier this
year.
Signed-off-by: dann frazier <dannf@hp.com>
dann frazier [Tue, 22 Jan 2008 00:14:49 +0000 (17:14 -0700)]
avoid semi-infinite loop when mounting bad ext2
This is a 2.4 backport of a linux-2.6 change by Andries Brouwer
(old-2.6-bkcvs commit
c279c5343b1796bf1db4c0b4af2c99479a6575fe)
Commit log from 2.6 follows.
The routine ext2_readdir() will, when reading a directory page
returns an error, try the next page, without reporting the
error to user space. That is bad, and the patch below changes that.
In my case the filesystem was damaged, and ext2_readdir wanted
to read 60000+ pages and wrote as many error messages to syslog
("attempt to access beyond end"), not what one wants.
[no doubt a similar patch is appropriate for ext3]
Signed-off-by: dann frazier <dannf@hp.com>
dann frazier [Tue, 22 Jan 2008 00:13:06 +0000 (17:13 -0700)]
ext2_readdir() filp->f_pos fix
This is a 2.4 backport of a linux-2.6 change by Jan Blunck
(old-2.6-bkcvs commit
2196b4744393d4f6c06fc4d63b98556d05b90933)
Commit log from 2.6 follows.
[PATCH] ext2_readdir() filp->f_pos fix
If the whole directory is read, ext2_readdir() sets the f_pos to a multiple
of the page size (because of the conditions of the outer for loop). This
sets the wrong f_pos for directory inodes on ext2 partitions with a block
size differing from the page size.
Signed-off-by: dann frazier <dannf@hp.com>
Willy Tarreau [Sun, 13 Jan 2008 11:14:07 +0000 (12:14 +0100)]
Do not complain about gcc 4.2 for user-space
Some user-space include compiler.h, so do not disable gcc 4.2
if __KERNEL__ is not defined.
Problem reported and fix confirmed by Gabor Z. Papp :
"
gcc -Wp,-MT,syslinux.o,-MMD,.syslinux.o.d -W -Wall -D_FILE_OFFSET_BITS=64 -g -Os -I. -I.. -I../libinstaller -c -o syslinux.o syslinux.c
In file included from /usr/include/asm/byteorder.h:5,
from /usr/include/linux/msdos_fs.h:11,
from syslinux.c:51:
/usr/include/linux/compiler.h:45:2: error: #error "GCC >= 4.2 miscompiles kernel 2.4, do not use it!"
/usr/include/linux/compiler.h:46:2: error: #error "While the resulting kernel may boot, you will encounter random bugs"
/usr/include/linux/compiler.h:47:2: error: #error "at runtime. Only versions 2.95.3 to 4.1 are known to work reliably."
/usr/include/linux/compiler.h:48:2: error: #error "To build with another version, for instance 3.3, please do"
/usr/include/linux/compiler.h:49:2: error: #error " make bzImage CC=gcc-3.3 "
make[1]: *** [syslinux.o] Error 1
After patching compiler.h, compile was fine.
"
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Tue, 1 Jan 2008 12:06:40 +0000 (13:06 +0100)]
Change VERSION to 2.4.36
Willy Tarreau [Sun, 16 Dec 2007 23:16:40 +0000 (00:16 +0100)]
Change VERSION to 2.4.36-rc1
- net/ipv4/arp.c: Fix arp reply when sender ip 0
- fix arch/i386/config.in to be able to boot on 386
- usb: Move linux-usb-devel
- GCC >= 4.2 miscompiles the kernel
- prevent do_brk() from allocating below mmap_min_addr
- fix build of ia32entry.S on x86_64
- vfs: coredumping fix
- isdn: avoid copying overly-long strings
- prevent SIGCONT from waking up a PTRACED process (CVE-2007-4774)
- isdn: fix isdn_ioctl memory overrun vulnerability
Willy Tarreau [Sun, 16 Dec 2007 23:10:45 +0000 (00:10 +0100)]
[PATCH] isdn: fix isdn_ioctl memory overrun vulnerability
Backport of 2.6 commit
eafe1aa37e6ec2d56f14732b5240c4dd09f0613a by Karsten Keil
I4L: fix isdn_ioctl memory overrun vulnerability
Fix possible memory overrun issue in the isdn ioctl code.
Found by ADLAB <adlab@venustech.com.cn>
Signed-off-by: Karsten Keil <kkeil@suse.de>
Cc: ADLAB <adlab@venustech.com.cn>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 9 Dec 2007 22:03:24 +0000 (23:03 +0100)]
[PATCH] prevent SIGCONT from waking up a PTRACED process (CVE-2007-4774)
Tavis Ormandy discovered that it was possible to bypass systrace policies
by flooding the ptraced process with SIGCONT signals. The same is possible
with SIGKILL, but obviously the attacker has to finely adjust its target
as it can only shoot once.
This issue was assigned identifier CVE-2007-4774.
The following patch fixes the SIGCONT case and adds some documentation for
authors of monitoring programs such as systrace.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Acked-by: Tavis Ormandy <taviso@sdf.lonestar.org>
Willy Tarreau [Mon, 10 Dec 2007 06:17:13 +0000 (07:17 +0100)]
[PATCH] isdn: avoid copying overly-long strings
Backport of 2.6 commit
0f13864e5b24d9cbe18d125d41bfa4b726a82e40 by Karsten Keil
Addresses http://bugzilla.kernel.org/show_bug.cgi?id=9416
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Mon, 10 Dec 2007 06:00:14 +0000 (07:00 +0100)]
[PATCH] vfs: coredumping fix
Backport of 2.6 commit
c46f739dd39db3b07ab5deb4e3ec81e1c04a91af by Ingo Molnar.
fix: http://bugzilla.kernel.org/show_bug.cgi?id=3043
only allow coredumping to the same uid that the coredumping
task runs under.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 9 Dec 2007 18:38:53 +0000 (19:38 +0100)]
[PATCH] fix build of ia32entry.S on x86_64
Krzysztof Strasburger reported the following problem.
Commit
7e6ba255062b79f2cf34590ac0987abb335d29f1 broke build
of arch/x86_64/ia32/ia32entry.S with the following message :
ia32entry.S: Assembler messages:
ia32entry.S:76: Error: Incorrect register `%rax' used with `l' suffix
Solution is simply to replace cmpl with cmpq to fix the register problem.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Krzysztof Strasburger [Wed, 5 Dec 2007 12:43:08 +0000 (13:43 +0100)]
[PATCH] fix arch/i386/config.in to be able to boot on 386
I tried to run 2.4 on a really old machine with 386 processor, only to find
that the kernel does not boot, claiming that TSC is needed. It seems that
nobody (except me, of course) uses 386, as the bug in the config
script arch/i386/config.in, leading to CONFIG_X86_TSC enabled for 386,
seems to be very old and never noticed.
Willy Tarreau [Sun, 9 Dec 2007 18:14:03 +0000 (19:14 +0100)]
[PATCH] prevent do_brk() from allocating below mmap_min_addr
This is the 2.4 equivalent of the following 2.6 patch by Eric Paris :
ecaf18c15aac8bb9bed7b7aa0e382fe252e275d5
Given a specifically crafted binary do_brk() can be used to get low
pages available in userspace virtually memory and can thus be used to
circumvent the mmap_min_addr low memory protection. Add security checks
in do_brk().
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 9 Dec 2007 16:26:13 +0000 (17:26 +0100)]
[PATCH] GCC >= 4.2 miscompiles the kernel
Add a check for GCC >= 4.2 and refuse to use it. It miscompiles
kernel 2.4 in a very nasty way, and it's hard to identify faulty
modules.
Jonas Danielsson [Tue, 20 Nov 2007 16:28:22 +0000 (17:28 +0100)]
[PATCH] net/ipv4/arp.c: Fix arp reply when sender ip 0
Fix arp reply when received arp probe with sender ip 0.
Send arp reply with target ip address 0.0.0.0 and target hardware address
set to hardware address of requester. Previously sent reply with target
ip address and target hardware address set to same as source fields.
Signed-off-by: Jonas Danielsson <the.sator@gmail.com>
Acked-by: Alexey Kuznetov <kuznet@ms2.inr.ac.ru>
Pete Zaitcev [Sat, 24 Nov 2007 22:28:32 +0000 (14:28 -0800)]
usb: Move linux-usb-devel
Update documentation to reflect the new home of linux-usb list.
I did not try to fix any fiction accumulated (except taking over
printer from Vojtech). There is too much, so I only moved the list.
The patch was originally written by Steve Bangert.
Signed-off-by: Pete Zaitcev <zaitcev@redhat.com>
Willy Tarreau [Sat, 17 Nov 2007 19:27:03 +0000 (20:27 +0100)]
Change VERSION to 2.4.36-pre2
- x86_64: Make sure to validate all 64bits of ptrace information
- fix missing MODULE_LICENSE in some drivers
- fix unresolved symbols on alpha
- corrupted cramfs filesystems cause kernel oops (CVE-2006-5823)
- Bridge STP timer fixes
- sym53c8xx_2 SMP deadlock on driver load
- ATM: avoid kernel panic upon access to /proc/net/atm/arp
- PPP: fix crash using usb-serial on high speed devices
- [OpenPROM]: Fix signedness bug in openprom char driver
- [OpenPROM]: Fix user-access checking bugs in openpromfs
- [OpenPROM] Prevent overflow of sprintf buffer
- [OpenPROM] Prevent unsigned roll-overs in
- IDE: enable support for JMicron 20363
- IDE: enable PATA UDMA support for ICH7
ivaylo@bglans.net [Fri, 10 Aug 2007 21:31:30 +0000 (00:31 +0300)]
[PATCH] IDE: enable PATA UDMA support for ICH7
Hello,
I have ASUS P5LD2-VM mobo with Intel ICH7 PATA IDE. It works only
in PIO mode, so I changed piix driver in 2.4.35 to support UDMA modes -
patch is bellow.
I'm a little bit confused about the specifications of ICH7 PATA, from ASUS
say it is UDMA 100, but from Intel and in 2.6.XX kernel tree it is as UDMA
133. My confusion became stronger and from bios ide SATA/PATA options of
my mobo.
Anyway, the patch works for me and it should work for all mobos with 945
chipset, but need to be tested. If there are any volunteers to apply patch
and test it will be good.
Please report the results and play around with mobo bios SATA/PATA IDE
setings.
Best Regards,
Ivaylo Josifov
ivaylo@bglans.net [Thu, 9 Aug 2007 12:54:30 +0000 (15:54 +0300)]
[PATCH] IDE: enable support for JMicron 20363
Hello,
I have ASUS P5B-VM DO mobo with JMicron SATA/PATA controler. I write mail
to Alan Cox and he told me that PATA part of JMicron controler can be
pressant as generic ide. So I make some changes to generic ide driver in
kernel 2.4.35 to be support JMicron PATA controler, but I'm not advanced
in C programing and not sure what I did is right. It works for me.
If there are any interes I send you (see bellow) changes.
Best Regards.
Ivaylo Josifov
Moritz Muehlenhoff [Sun, 11 Nov 2007 17:02:24 +0000 (18:02 +0100)]
[PATCH] corrupted cramfs filesystems cause kernel oops (CVE-2006-5823)
From http://projects.info-pull.com/mokb/MOKB-07-11-2006.html :
| The zlib_inflate function in Linux kernel 2.6.x allows local users to cause a
| denial of service (crash) via a malformed filesystem that uses zlib
| compression that triggers memory corruption, as demonstrated using cramfs.
We could reproduce this with 2.4.27, since there aren't any changes to git
for cramfs since initial import this is likely unfixed in 2.4.35 too.
2.6 patch below.
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=
8bb0269160df2a60764013994d0bc5165406cf4a
| Steve Grubb's fzfuzzer tool (http://people.redhat.com/sgrubb/files/
| fsfuzzer-0.6.tar.gz) generates corrupt Cramfs filesystems which cause
| Cramfs to kernel oops in cramfs_uncompress_block(). The cause of the oops
| is an unchecked corrupted block length field read by cramfs_readpage().
|
| This patch adds a sanity check to cramfs_readpage() which checks that the
| block length field is sensible. The (PAGE_CACHE_SIZE << 1) size check is
| intentional, even though the uncompressed data is not going to be larger
| than PAGE_CACHE_SIZE, gzip sometimes generates compressed data larger than
| the original source data. Mkcramfs checks that the compressed size is
| always less than or equal to PAGE_CACHE_SIZE << 1. Of course Cramfs could
| use the original uncompressed data in this case, but it doesn't.
|
| Signed-off-by: Phillip Lougher <phillip@lougher.org.uk>
| Signed-off-by: Andrew Morton <akpm@osdl.org>
| Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Willy Tarreau [Sun, 11 Nov 2007 15:47:50 +0000 (16:47 +0100)]
[PATCH] PPP: fix crash using usb-serial on high speed devices
Problem discussed here and reported and tracked by Gilles Espinasse :
https://sourceforge.net/tracker/index.php?func=detail&aid=
1678777&group_id=40604&atid=428519
Patch and description provided by David W Studeman :
"...This patch prevents the kernel from crashing during uploads with
some 3G devices. On my XU870, certain irc rooms would cause my machine
to crash and reboot. This also happened with the Nozomi drivers and
the Option GT Max when uploading torrents. Neither happen anymore with
the ppp_async patched driver."
On linux-ppp, James Cameron confirmed to Gilles that the patch fixes
the hangs problem for him :
http://marc.info/?l=linux-ppp&m=
118711617415737&w=2
Tony Battersby [Wed, 17 Oct 2007 16:22:11 +0000 (12:22 -0400)]
[PATCH] sym53c8xx_2 SMP deadlock on driver load
This patch fixes two problems with sym53c8xx_2.o in 2.4.x kernels:
1) A system hang when loading sym53c8xx_2.o on a SMP system with two
dual-channel LSI HBAs (http://bugzilla.kernel.org/show_bug.cgi?id=3680)
2) A function improperly marked __init.
Comment from Matthew Wilcox:
" This is a pretty ugly patch, but I think the three alternatives are
worse:
- Drop the iorl at the beginning of ->detect and reacquire it at exit.
We don't know what else the iorl might be protecting. Probably
nothing, but I don't want to audit it.
- Convert sym2 back to old error handling so the midlayer doesn't
acquire the iorl for us in ->detect.
- Acquire the iorl in ->release. We might deadlock on something.
So, sure, apply this patch. "
Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
Gilles Espinasse [Sun, 11 Nov 2007 15:27:43 +0000 (16:27 +0100)]
[PATCH] fix unresolved symbols on alpha
When compiling the out-of-tree e100 driver, some unresolved symbols
errors happened due to the fact that asm-alpha/pci.h does not include
asm/io.h, contrarily to most other archs.
This trivial patch fixes the problem.
Franck Bourdonnec [Sun, 11 Nov 2007 15:17:22 +0000 (16:17 +0100)]
[PATCH] fix missing MODULE_LICENSE in some drivers
I was looking at our installer output (IPCop) and saw
module 3C523 tainting kernel.
Looking at the source (drivers/net/3C523.c) it is gpl
source and it misses then
MODULE_LICENSE("GPL");
Reading that this source '3c523.c' is based on 'ni52.c' a
look inside 'ni52.c' shows the MODULE_LICENSE....
but not inside the correct #ifdef module ..... #endif
Here come fixes for other missing GPL entries in drivers/net
when GPL was indicated somewhere.
dann frazier [Tue, 6 Nov 2007 22:38:31 +0000 (15:38 -0700)]
[PATCH 4/4] [OpenPROM] Prevent unsigned roll-overs in
property_read/property_write
These overflow fixes were originally submitted to 2.5 by Dave Miller:
http://linux.bkbits.net:8080/linux-2.6/?PAGE=cset&REV=3d69d83b4f8vl6uetYp1vi77lhBJOQ
http://linux.bkbits.net:8080/linux-2.6/?PAGE=cset&REV=3d6aabcc3jBCcQB6wlZ7s3G9WGPYsg
Signed-off-by: dann frazier <dannf@hp.com>
dann frazier [Tue, 6 Nov 2007 22:37:56 +0000 (15:37 -0700)]
[PATCH 3/4] [OpenPROM] Prevent overflow of sprintf buffer
This patch fixes a few potential overflows, originally submitted to 2.5 by
Dave Miller:
http://linux.bkbits.net:8080/linux-2.6/?PAGE=cset&REV=3d69d753xoJv6rAeuQzdAcJK6Njncg
http://linux.bkbits.net:8080/linux-2.6/?PAGE=cset&REV=3d6aabcc3jBCcQB6wlZ7s3G9WGPYsg
Signed-off-by: dann frazier <dannf@hp.com>
dann frazier [Tue, 6 Nov 2007 22:37:30 +0000 (15:37 -0700)]
[PATCH 2/4] [OpenPROM]: Fix user-access checking bugs in openpromfs
This patch backports a number of user-access checking fixes, originally
submitted to 2.5 by Dave Miller:
http://linux.bkbits.net:8080/linux-2.6/?PAGE=cset&REV=3d686423le0SEotURGfYEbgMpPGKqw
Signed-off-by: dann frazier <dannf@hp.com>
dann frazier [Tue, 6 Nov 2007 22:36:46 +0000 (15:36 -0700)]
[PATCH 1/4] [OpenPROM]: Fix signedness bug in openprom char driver
CVE-2004-2731 describes two issues in the openprom driver.
The first issue, an integer overflow in copyin_string(), appears to be
fixed in 2.4. The second issue, an overflow in copyin(), is still present.
A description of both issues is here:
http://www.securityfocus.com/archive/1/367575
The user-provided 'bufsize' is checked for being too large, but is not checked
for being negative. This patch avoids this situation by making bufsize
unsigned.
This change has been in 2.6 for a number of years now:
http://linux.bkbits.net:8080/linux-2.6/?PAGE=patch&REV=3d686423le0SEotURGfYEbgMpPGKqw
Signed-off-by: dann frazier <dannf@hp.com>
Willy Tarreau [Sun, 23 Sep 2007 21:56:49 +0000 (23:56 +0200)]
[PATCH] ATM: avoid kernel panic upon access to /proc/net/atm/arp
Gilles Espinasse reported that if one user tried to read
/proc/net/atm/arp with the atm.o module loaded but without
clip.o, then the kernel would panic.
This is caused by a neighbour table which is NULL when the
CLIP module is not loaded. 2.6 has fixed this by managing
the "arp" entry within clip.o. Here, a less intrusive workaround
consists in returning -EAGAIN to open() if CLIP is not loaded.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Andi Kleen [Sun, 23 Sep 2007 20:08:49 +0000 (22:08 +0200)]
[PATCH] x86_64: Make sure to validate all 64bits of ptrace information
This is CVE-2007-4573, found by Wojciech Purczynski.
Signed-off-by: Andi Kleen <ak@suse.de>
Stephen Hemminger [Tue, 21 Aug 2007 18:53:21 +0000 (11:53 -0700)]
[PATCH] Bridge STP timer fixes
Fix a couple of obvious places in 2.4 code where bridge timers are
set to values < current jiffies. This was a bug (mostly harmless)
that makes timer fires too soon.
Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Willy Tarreau [Sat, 8 Sep 2007 17:44:50 +0000 (19:44 +0200)]
Change VERSION to 2.4.36-pre1
- b44: fix force mac address before ifconfig up
- build fix for lvm with gcc 4
- fix wdt83627 build breakage with gcc 4.x
- wdt83627: fix wdt_init() return code
- module fdomain_cs requires fdomain_setup()
- do not use gcc's builtin strpbrk
- fix incorrect use of -fno-unit-at-a-time on GCC >= 4
- second build fix for some rare buggy versions of GCC 4
- CVE-2007-3848 Privilege escalation via PR_SET_PDEATHSIG
- i386: do_test_wp_bit() must not be inlined
- restore -fno-unit-at-a-time on GCC >= 4
- sysctl to prevent normal processes from mapping NULL
Willy Tarreau [Mon, 13 Aug 2007 08:50:08 +0000 (10:50 +0200)]
[PATCH] sysctl to prevent normal processes from mapping NULL
After a patch proposal from Solar Designer, and discussions with
Alan Cox and Chris Wright, I modeled this patch which permits to
restrict mapping of lower virtual addresses to CAP_RAW_IO capable
processes only.
This makes it harder for processes to try to exploit NULL pointer
dereference bugs in the kernel.
In order to ease transition from 2.4 to 2.6, the patch has also
been inspired by Eric Paris's patch now present in 2.6, which
adds the sys/vm/mmap_min_addr sysctl by which the lowest mappable
address is set. This sysctl defaults to zero, meaning NULL is
allowed by default.
According to test ran by Solar Designer, both Xorg and Wine run
correctly as a normal user with the restriction enabled. There
should be very few regressions when enabling it, and it is
recommended to enable it on servers after the obviously needed
validation.
Alan points that some rare programs use a trick consisting in
mapping this page in order to reduce the number of NULL checks
in linked lists for instance.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sat, 8 Sep 2007 15:32:26 +0000 (17:32 +0200)]
[PATCH] restore -fno-unit-at-a-time on GCC >= 4
-fno-unit-at-a-time was removed for gcc >= 4 in order to
support gcc 4.2. Unfortunately, this caused nasty problems
in many modules which had some of their read-only parameters
optimized away.
So we have to restore -fno-unit-at-a-time for the moment.
This will break gcc 4.2 again, and another solution will be
needed in order to support it. Note that -fno-unit-at-a-time
may not be supported in future versions of gcc.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Wed, 5 Sep 2007 21:39:11 +0000 (23:39 +0200)]
[PATCH] i386: do_test_wp_bit() must not be inlined
do_test_wp_bit() has a comment stating that it must not be inlined.
Unfortunately, the trick to prevent it from being inlined is not
reliable under gcc 4.x.
The simple fix consists in specifying the noinline attribute.
Tested and confirmed to produce the correct code for gcc versions
2.95.3, 3.3.6, 3.4.6, 4.0.2, 4.1.1 and 4.2.1.
Special thanks to Axel Reinhold and Richard Kojedzinszky for their
continuous feedback when trying to solve this issue.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Wed, 15 Aug 2007 07:15:09 +0000 (09:15 +0200)]
[PATCH] CVE-2007-3848 Privilege escalation via PR_SET_PDEATHSIG
Fix the "parent process death signal" vulnerability in the Linux kernel
discovered by Wojciech Purczynski of COSEINC PTE Ltd. and iSEC Security
Research (CVE-2007-3848).
To sum up, any local user could manage to start a setuid program then
send it an arbitrary signal while it is running, by first setting the
PR_SET_PDEATHSIG argument of the prctl() system call, and then running
another setuid program from the parent process. This is something the
user is normally supposed to be able to do only as long as the setuid
program has not completely switched its UID.
Depending on the installed setuid programs, this may lead to either a
denial of service or even to a privilege escalation, so this issue is
very distribution specific.
For more information regarding this issue, please refer to the original
advisory :
http://www.isec.pl/vulnerabilities/isec-0024-death-signal.txt
The following fix has been provided by Solar Designer and is already
part of the latest Openwall kernel.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Thu, 9 Aug 2007 21:07:01 +0000 (23:07 +0200)]
[PATCH] second build fix for some rare buggy versions of GCC 4
Last gcc4 fix
78bf0892b4008a0011f7af916460bc59103acd0a uncoverred a known
bug which appeared in gcc between 4.1 and 4.2.0 and which makes it ignore
the first -fno-builtin-xxx when more than one of those params is passed.
This resulted in the kernel not building with some versions such as
gcc version 4.1.2
20061115 (prerelease) as shipped by Debian as version
4.1.1-21.
Since those versions do not need -fno-builtin-strpbrk, set this option
first so that it doesn't matter wether it's ignored. This fix was confirmed
by Richard Kojedzinszky. So with this fix, we know the kernel builds on x86
with gcc-4.1.1 (already did), 4.1.2-
20061115, and 4.2.1.
Reference to the thread discussing this bug on gcc-ml :
http://gcc.gnu.org/ml/gcc-bugs/2006-07/msg01514.html
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 5 Aug 2007 16:37:07 +0000 (18:37 +0200)]
[PATCH] fix incorrect use of -fno-unit-at-a-time on GCC >= 4
Axel Reinhold reported wrong code being emitted for arch/i386/kernel/i8259.c
using gcc-4.2, while the same code with gcc-4.1 was valid. The problem was
tracked down to gcc-4.2 messing up with sections with this option which is
already deprecated for gcc 4.x, and the asm statements were incorrectly
assigned to section .data. It was also possible to trick gcc-4.1 into the
same error by simply declaring an array before any asm statement.
The correct fix is to remove -fno-unit-at-a-time with gcc >= 4, which is
also what has been done in 2.6. In anticipation of such other problems with
gcc 4.x, a new function "if_gcc4" has been added to the main Makefile.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 5 Aug 2007 18:29:52 +0000 (20:29 +0200)]
[PATCH] do not use gcc's builtin strpbrk
Some drivers rely on strpbrk and complain about a lack of strchr().
This is caused by gcc's builtin strpbrk which must be disabled.
Willy Tarreau [Sun, 5 Aug 2007 18:48:46 +0000 (20:48 +0200)]
[PATCH] module fdomain_cs requires fdomain_setup()
The function which was called was once declared static
and once extern. Also, the arguments were messed up. That
one must not have worked for a long time.
Willy Tarreau [Sun, 5 Aug 2007 19:12:11 +0000 (21:12 +0200)]
[PATCH] wdt83627: fix wdt_init() return code
wdt_init() could return an uninitialized value if it
could not create a /proc entry.
Willy Tarreau [Sun, 5 Aug 2007 19:50:20 +0000 (21:50 +0200)]
[PATCH] fix wdt83627 build breakage with gcc 4.x
gcc 4 complains about a function declared static after
being used.
Marc Haisenko [Fri, 3 Aug 2007 12:34:39 +0000 (14:34 +0200)]
[PATCH] b44: fix force mac address before ifconfig up
Hi Willy,
I discovered that a bug in the Broadcom driver that has been fixed in the 2.6
tree is still present in 2.4 (up to 2.4.35). In our case it resulted in a
complete system crash when starting the net-snmp daemon (not even a kernel
panic is seen; the system is just gone).
The patch is rather trivial, here's the link to the patch from the netdev
tree:
http://git.kernel.org/?p=linux/kernel/git/jgarzik/netdev-2.6.git;a=commit;h=
5c5131297db57b501f371ab53c40343eac6f2af7
It applies cleanly to 2.4.35 (with fuzz offset, of course :-)
Bye,
Marc
--
Marc Haisenko
Comdasys AG
---- patch below ----
From: Gary Zambrano <zambrano@broadcom.com>
Date: Wed, 29 Mar 2006 22:12:05 -0500
Subject: b44: fix force mac address before ifconfig up
Initializing the b44 MAC & PCI functional blocks in the controller must
occur inside init_one(). This will allow access to the MAC registers.
The controller was being powered up in b44_open() which would not allow
access to the registers before ifconfig was up.
Philip Kohlbecher found this bug.
Signed-off-by: Gary Zambrano <zambrano@broadcom.com>