Skip to content


Subversion checkout URL

You can clone with
Download ZIP
Commits on Apr 18, 2006
  1. @gregkh


    gregkh committed
  2. @gregkh

    [PATCH] ip_route_input panic fix (CVE-2006-1525)

    Stephen Hemminger committed with gregkh
    This fixes
    The bug is caused by ip_route_input dereferencing skb->nh.protocol of
    the dummy skb passed dow from inet_rtm_getroute (Thanks Thomas for seeing
    it). It only happens if the route requested is for a multicast IP
    Signed-off-by: Stephen Hemminger <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Greg Kroah-Hartman <>
Commits on Apr 17, 2006
  1. @gregkh


    gregkh committed
  2. @gregkh

    [PATCH] fix MADV_REMOVE vulnerability (CVE-2006-1524 for real this time)

    Hugh Dickins committed with gregkh
    madvise_remove needs to respect file and mmap protections.
    Signed-off-by: Hugh Dickins <>
    Signed-off-by: Greg Kroah-Hartman <>
  3. @gregkh


    gregkh committed
  4. @gregkh

    [PATCH] shmat: stop mprotect from giving write permission to a readon…

    Hugh Dickins committed with gregkh
    …ly attachment (CVE-2006-1524)
    I found that all of 2.4 and 2.6 have been letting mprotect give write
    permission to a readonly attachment of shared memory, whether or not IPC
    would give the caller that permission.
    SUS says "The behaviour of this function [mprotect] is unspecified if the
    mapping was not established by a call to mmap", but I don't think we can
    interpret that as allowing it to subvert IPC permissions.
    I haven't tried 2.2, but the 2.2.26 source looks like it gets it right; and
    the patch below reproduces that behaviour - mprotect cannot be used to add
    write permission to a shared memory segment attached readonly.
    This patch is simple, and I'm sure it's what we should have done in 2.4.0:
    if you want to go on to switch write permission on and off with mprotect,
    just don't attach the segment readonly in the first place.
    However, we could have accumulated apps which attach readonly (even though
    they would be permitted to attach read/write), and which subsequently use
    mprotect to switch write permission on and off: it's not unreasonable.
    I was going to add a second ipcperms check in do_shmat, to check for
    writable when readonly, and if not writable find_vma and clear VM_MAYWRITE.
     But security_ipc_permission might do auditing, and it seems wrong to
    report an attempt for write permission when there has been none.  Or we
    could flag the vma as SHM, note the shmid or shp in vm_private_data, and
    then get mprotect to check.
    But the patch below is a lot simpler: I'd rather stick with it, if we can
    convince ourselves somehow that it'll be safe.
    Signed-off-by: Hugh Dickins <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Greg Kroah-Hartman <>
  5. @gregkh

    [PATCH] atm: clip causes unregister hang

    Stephen Hemminger committed with gregkh
    If Classical IP over ATM module is loaded, its neighbor table gets
    populated when permanent neighbor entries are created; but these entries
    are not flushed when the device is removed. Since the entry never gets
    flushed the unregister of the network device never completes.
    This version of the patch also adds locking around the reference to
    the atm arp daemon to avoid races with events and daemon state changes.
    (Note: barrier() was never really safe)
    Signed-off-by: Stephen Hemminger <>
    Signed-off-by: Greg Kroah-Hartman <>
  6. @gregkh

    [PATCH] fix non-leader exec under ptrace

    Roland McGrath committed with gregkh
    This reverts most of commit 30e0fca.
    It broke the case of non-leader MT exec when ptraced.
    I think the bug it was intended to fix was already addressed by commit
    Signed-off-by: Roland McGrath <>
    Signed-off-by: Greg Kroah-Hartman <>
  7. @gregkh

    [PATCH] USB: remove __init from usb_console_setup

    Paul Fulghum committed with gregkh
    This prevents an Oops if booted with "console=ttyUSB0" but without a
    USB-serial dongle, and plugged one in afterwards.
    Signed-off-by: Greg Kroah-Hartman <>
  8. @gregkh

    [PATCH] Fix suspend with traced tasks

    Pavel Machek committed with gregkh
    strace /bin/bash misbehaves after resume; this fixes it.
    (akpm: it's scary calling refrigerator() in state TASK_TRACED, but it seems to
    do the right thing).
    Signed-off-by: Pavel Machek <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
  9. @gregkh

    [PATCH] Incorrect signature sent on SMB Read

    Steve French committed with gregkh
    Fixes Samba bug 3621 and bug 6147
    For servers which require SMB/CIFS packet signing, we were sending the
    wrong signature (all zeros) on SMB Read request.  The new cifs routine
    to do signatures across an iovec was not complete - and SMB Read, unlike
    the new SMBWrite2, did not fall back to the older routine (ie use
    SendReceive vs. the more efficient SendReceive2 ie used the older
    cifs_sign_smb vs. the disabled  cifs_sign_smb2) for calculating signatures.
    This finishes up cifs_sign_smb2/cifs_calc_signature2 so that the callers
    of SendReceive2 can get SMB/CIFS packet signatures.
    Now that cifs_sign_smb2 is supported, we could start using it in
    the write path but this smaller fix does not include the change
    to use SMBWrite2 when signatures are required (which when enabled
    will make more Writes more efficient and alloc less memory).
    Currently Write2 is only used when signatures are not
    required at the moment but after more testing we will enable
    that as well).
    Thanks to James Slepicka and Sam Flory for initial investigation.
    Signed-off-by: Steve French <>
    Signed-off-by: Greg Kroah-Hartman <>
  10. @gregkh

    [PATCH] RLIMIT_CPU: fix handling of a zero limit

    Andrew Morton committed with gregkh
    At present the kernel doesn't honour an attempt to set RLIMIT_CPU to zero
    seconds.  But the spec says it should, and that's what 2.4.x does.
    Fixing this for real would involve some complexity (such as adding a new
    it-has-been-set flag to the task_struct, and testing that everwhere, instead
    of overloading the value of it_prof_expires).
    Given that a 2.4 kernel won't actually send the signal until one second has
    expired anyway, let's just handle this case by treating the caller's
    zero-seconds as one second.
    Cc: Martin Schwidefsky <>
    Cc: Ulrich Weigand <>
    Cc: Cliff Wickman <>
    Acked-by: Ingo Molnar <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
  11. @gregkh

    [PATCH] Fix utime(2) in the case that no times parameter was passed in.

    Nathan Scott committed with gregkh
    SGI-PV: 949858
    SGI-Modid: xfs-linux-melb:xfs-kern:25717a
    Signed-off-by: Jes Sorensen <>
    Signed-off-by: Nathan Scott <>
  12. @gregkh

    [PATCH] alpha: SMP boot fixes

    Brian Uhrain says committed with gregkh
    I've encountered two problems with 2.6.16 and newer kernels on my API CS20
    (dual 833MHz Alpha 21264b processors).  The first is the kernel OOPSing
    because of a NULL pointer dereference while trying to populate SysFS with the
    CPU information.  The other is that only one processor was being brought up.
    I've included a small Alpha-specific patch that fixes both problems.
    The first problem was caused by the CPUs never being properly registered using
    register_cpu(), the way it's done on other architectures.
    The second problem has to do with the removal of hwrpb_cpu_present_mask in
    arch/alpha/kernel/smp.c.  In setup_smp() in the 2.6.15 kernel sources,
    hwrpb_cpu_present_mask has a bit set for each processor that is probed, and
    afterwards cpu_present_mask is set to the cpumask for the boot CPU.  In the
    same function of the same file in the 2.6.16 sources, instead of
    hwrpb_cpu_present_mask being set, cpu_possible_map is updated for each probed
    CPU.  cpu_present_mask is still set to the cpumask of the boot CPU afterwards.
     The problem lies in include/asm-alpha/smp.h, where cpu_possible_map is
    #define'd to be cpu_present_mask.
    Cleanups from: Ivan Kokshaysky <>
     - cpu_present_mask and cpu_possible_map are essentially the same thing
       on alpha, as it doesn't support CPU hotplug;
     - allocate "struct cpu" only for present CPUs, like sparc64 does.
       Static array of "struct cpu" is just a waste of memory.
    Signed-off-by: Brian Uhrain <>
    Cc: Richard Henderson <>
    Cc: Ivan Kokshaysky <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Greg Kroah-Hartman <>
  13. @gregkh

    [PATCH] cciss: bug fix for crash when running hpacucli

    Mike Miller committed with gregkh
    Fix a crash when running hpacucli with multiple logical volumes on a cciss
    controller.  We were not properly initializing the disk->queue and causing
    a fault.
    Thanks to Hasso Tepper for reporting the problem.  Thanks to Steve Cameron
    for root causing the problem.  Most of the patch just moves things around.
    The fix is a one-liner.
    Signed-off-by: Mike Miller <>
    Signed-off-by: Stephen Cameron <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Greg Kroah-Hartman <>
  14. @gregkh

    [PATCH] edac_752x needs CONFIG_HOTPLUG

    Randy Dunlap committed with gregkh
    EDAC_752X uses pci_scan_single_device(), which is only available
    if CONFIG_HOTPLUG is enabled, so limit this driver with HOTPLUG.
    This patch was already included in Linus' tree.
    Adrian Bunk:
    Rediffed for 2.6.16.x due to unrelated context changes.
    Signed-off-by: Randy Dunlap <>
    Signed-off-by: Adrian Bunk <>
    Signed-off-by: Greg Kroah-Hartman <>
    Signed-off-by: David S. Peterson <>
  15. @gregkh

    [PATCH] ext3: Fix missed mutex unlock

    Ananiev, Leonid I committed with gregkh
    Missed unlock_super()call is added in error condition code path.
    Signed-off-by: Leonid Ananiev <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Greg Kroah-Hartman <>
  16. @gregkh

    [PATCH] Fix block device symlink name

    Stephen Rothwell committed with gregkh
    As noted further on the this file, some block devices have a / in their
    name, so fix the "block:..." symlink name the same as the /sys/block name.
    Signed-off-by: Stephen Rothwell <>
    Cc: Al Viro <>
    Cc: Christoph Hellwig <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Greg Kroah-Hartman <>
  17. @gregkh

    [PATCH] Fix buddy list race that could lead to page lru list corruptions

    Nick Piggin committed with gregkh
    Rohit found an obscure bug causing buddy list corruption.
    page_is_buddy is using a non-atomic test (PagePrivate && page_count == 0)
    to determine whether or not a free page's buddy is itself free and in the
    buddy lists.
    Each of the conjuncts may be true at different times due to unrelated
    conditions, so the non-atomic page_is_buddy test may find each conjunct to
    be true even if they were not both true at the same time (ie. the page was
    not on the buddy lists).
    Signed-off-by: Martin Bligh <>
    Signed-off-by: Rohit Seth <>
    Signed-off-by: Nick Piggin <>
    Signed-off-by: KAMEZAWA Hiroyuki <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
  18. @gregkh

    [PATCH] fuse: fix oops in fuse_send_readpages()

    Miklos Szeredi committed with gregkh
    During heavy parallel filesystem activity it was possible to Oops the
    kernel.  The reason is that read_cache_pages() could skip pages which
    have already been inserted into the cache by another task.
    Occasionally this may result in zero pages actually being sent, while
    fuse_send_readpages() relies on at least one page being in the
    So check this corner case and just free the request instead of trying
    to send it.
    Reported and tested by Konstantin Isakov.
    Signed-off-by: Miklos Szeredi <>
    Signed-off-by: Greg Kroah-Hartman <>
  19. @htakata @gregkh

    [PATCH] m32r: Fix cpu_possible_map and cpu_present_map initialization…

    htakata committed with gregkh
    … for SMP kernel
    This patch fixes a boot problem of the m32r SMP kernel 2.6.16-rc1-mm3 or
    In this patch, cpu_possible_map is statically initialized, and cpu_present_map
    is also copied from cpu_possible_map in smp_prepare_cpus(), because the m32r
    architecture has not supported CPU hotplug yet.
    Signed-off-by: Hayato Fujiwara <>
    Signed-off-by: Hirokazu Takata <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Greg Kroah-Hartman <>
  20. @htakata @gregkh

    [PATCH] m32r: security fix of {get, put}_user macros

    htakata committed with gregkh
    Update {get,put}_user macros for m32r kernel.
    - Modify get_user to use __get_user_asm macro, instead of __get_user_x macro.
    - Remove arch/m32r/lib/{get,put}user.S.
    - Some cosmetic updates.
    I would like to thank NIIBE Yutaka for his reporting about the m32r kernel's
    security problem in {get,put}_user macros.
    There were no address checking for user space access in {get,put}_user macros.
    Signed-off-by: Hirokazu Takata <>
    Cc: NIIBE Yutaka <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Greg Kroah-Hartman <>
  21. @kaber @gregkh

    [PATCH] NETFILTER: Fix fragmentation issues with bridge netfilter

    kaber committed with gregkh
    [NETFILTER]: Fix fragmentation issues with bridge netfilter
    The conntrack code doesn't do re-fragmentation of defragmented packets
    anymore but relies on fragmentation in the IP layer. Purely bridged
    packets don't pass through the IP layer, so the bridge netfilter code
    needs to take care of fragmentation itself.
    Signed-off-by: Patrick McHardy <>
    Signed-off-by: Greg Kroah-Hartman <>
  22. @gregkh

    [PATCH] sky2: bad memory reference on dual port cards

    Stephen Hemminger committed with gregkh
    Sky2 driver will oops referencing bad memory if used on
    a dual port card.  The problem is accessing past end of
    MIB counter space.
    Signed-off-by: Stephen Hemminger <>
    Signed-off-by: Greg Kroah-Hartman <>
  23. @gregkh

    [PATCH] isd200: limit to BLK_DEV_IDE

    Randy Dunlap committed with gregkh
    Limit USB_STORAGE_ISD200 to whatever BLK_DEV_IDE and USB_STORAGE
    are set to (y, m) since isd200 calls ide_fix_driveid() in the
    BLK_DEV_IDE code.
    Signed-off-by: Randy Dunlap <>
    Signed-off-by: Greg Kroah-Hartman <>
  24. @gregkh

    [PATCH] MPBL0010 driver sysfs permissions wide open

    Mark Bellon committed with gregkh
    The MPBL0010 Telco clock driver (drivers/char/tlclk.c) uses 0222 (anyone
    can write) permissions on its writable sysfs entries.  Alter the
    permissions to 0220 (owner and group can write).
    The use case for this driver is to configure the fail over behavior of the
    clock hardware.  That should be done by the more privileged users.
    Signed-off-by: Mark Bellon <>
    Acked-by: Gross Mark <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Greg Kroah-Hartman <>
  25. @gregkh

    [PATCH] powerpc: fix incorrect SA_ONSTACK behaviour for 64-bit processes

    Laurent MEYER committed with gregkh
    *) When setting a sighandler using sigaction() call, if the flag
    SA_ONSTACK is set and no alternate stack is provided via sigaltstack(),
    the kernel still try to install the alternate stack. This behavior is
    the opposite of the one which is documented in Single Unix
    Specifications V3.
    *) Also when setting an alternate stack using sigaltstack() with the
    flag SS_DISABLE, the kernel try to install the alternate stack on
    signal delivery.
    These two use cases makes the process crash at signal delivery.
    This fixes it.
    Signed-off-by: Laurent Meyer <>
    Signed-off-by: Paul Mackerras <>
    Signed-off-by: Greg Kroah-Hartman <>
  26. @gregkh

    [PATCH] powerpc: iSeries needs slb_initialize to be called

    Stephen Rothwell committed with gregkh
    Since the powerpc 64k pages patch went in, systems that have SLBs
    (like Power4 iSeries) needed to have slb_initialize called to set up
    some variables for the SLB miss handler.  This was not being called
    on the boot processor on iSeries, so on single cpu iSeries machines,
    we would get apparent memory curruption as soon as we entered user mode.
    This patch fixes that by calling slb_initialize on the boot cpu if the
    processor has an SLB.
    Signed-off-by: Stephen Rothwell <>
    Signed-off-by: Greg Kroah-Hartman <>
Commits on Apr 12, 2006
  1. @gregkh


    gregkh committed
  2. @gregkh

    [PATCH] x86_64: When user could have changed RIP always force IRET (C…

    Andi Kleen committed with gregkh
    Intel EM64T CPUs handle uncanonical return addresses differently from
    AMD CPUs.
    The exception is reported in the SYSRET, not the next instruction.
    Thgis leads to the kernel exception handler running on the user stack
    with the wrong GS because the kernel didn't expect exceptions on this
    This version of the patch has the teething problems that plagued an
    earlier version fixed.
    This is CVE-2006-0744
    Thanks to Ernie Petrides and Asit B. Mallick for analysis and initial
    Signed-off-by: Andi Kleen <>
    Signed-off-by: Greg Kroah-Hartman <>
  3. @gregkh

    [PATCH] x86_64: Clean up execve

    Andi Kleen committed with gregkh
    Just call IRET always, no need for any special cases.
    Needed for the next bug fix.
    Signed-off-by: Andi Kleen <>
    Signed-off-by: Greg Kroah-Hartman <>
Commits on Apr 11, 2006
  1. @gregkh


    gregkh committed
  2. @gregkh

    [PATCH] RCU signal handling

    Oleg Nesterov committed with gregkh
    made this BUG_ON() unsafe. This code runs under ->siglock,
    while switch_exec_pids() takes tasklist_lock.
    Signed-off-by: Oleg Nesterov <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
  3. @gregkh


    gregkh committed
  4. @gregkh

    [PATCH] Keys: Fix oops when adding key to non-keyring [CVE-2006-1522]

    David Howells committed with gregkh
    This fixes the problem of an oops occuring when a user attempts to add a
    key to a non-keyring key [CVE-2006-1522].
    The problem is that __keyring_search_one() doesn't check that the
    keyring it's been given is actually a keyring.
    I've fixed this problem by:
     (1) declaring that caller of __keyring_search_one() must guarantee that
         the keyring is a keyring; and
     (2) making key_create_or_update() check that the keyring is a keyring,
         and return -ENOTDIR if it isn't.
    This can be tested by:
    	keyctl add user b b `keyctl add user a a @s`
    Signed-off-by: David Howells <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>
Something went wrong with that request. Please try again.