linux-toradex.git, branch v2.6.16.14 Linux kernel for Apalis and Colibri modules Linux 2.6.16.14 2006-05-05T00:03:45+00:00 Chris Wright chrisw@sous-sol.org 2006-05-05T00:03:45+00:00 bf7d8bacaaf241a0f0157986fd4e1e6834873d50 






[PATCH] smbfs chroot issue (CVE-2006-1864)
2006-05-05T00:03:36+00:00

Olaf Kirch
okir@suse.de

2006-05-04T04:30:11+00:00

4acbb3fbaccda1f1d38e7154228e052ce80a2dfa

Mark Moseley reported that a chroot environment on a SMB share can be
left via "cd ..\\".  Similar to CVE-2006-1863 issue with cifs, this fix
is for smbfs.

Steven French <sfrench@us.ibm.com> wrote:

Looks fine to me.  This should catch the slash on lookup or equivalent,
which will be all obvious paths of interest.

Signed-off-by: Chris Wright <chrisw@sous-sol.org>





Mark Moseley reported that a chroot environment on a SMB share can be
left via "cd ..\\".  Similar to CVE-2006-1863 issue with cifs, this fix
is for smbfs.

Steven French <sfrench@us.ibm.com> wrote:

Looks fine to me.  This should catch the slash on lookup or equivalent,
which will be all obvious paths of interest.

Signed-off-by: Chris Wright <chrisw@sous-sol.org>







Linux 2.6.16.13
2006-05-02T21:38:44+00:00

Greg Kroah-Hartman
gregkh@suse.de

2006-05-02T21:38:44+00:00

a120571fbdfc8f543eea64248abe3c4d7f210450












[PATCH] NETFILTER: SCTP conntrack: fix infinite loop (CVE-2006-1527)
2006-05-02T21:38:21+00:00

Patrick McHardy
kaber@trash.net

2006-05-02T21:23:07+00:00

25b6badde42165b717e3c232e4992b3f6761920a

[NETFILTER]: SCTP conntrack: fix infinite loop

fix infinite loop in the SCTP-netfilter code: check SCTP chunk size to
guarantee progress of for_each_sctp_chunk(). (all other uses of
for_each_sctp_chunk() are preceded by do_basic_checks(), so this fix
should be complete.)

Based on patch from Ingo Molnar <mingo@elte.hu>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>





[NETFILTER]: SCTP conntrack: fix infinite loop

fix infinite loop in the SCTP-netfilter code: check SCTP chunk size to
guarantee progress of for_each_sctp_chunk(). (all other uses of
for_each_sctp_chunk() are preceded by do_basic_checks(), so this fix
should be complete.)

Based on patch from Ingo Molnar <mingo@elte.hu>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>







Linux 2.6.16.12
2006-05-01T19:14:26+00:00

Greg Kroah-Hartman
gregkh@suse.de

2006-05-01T19:14:26+00:00

42a46c74c4520174b82a60ac44c15b5525cdf238












[PATCH] i386: fix broken FP exception handling
2006-05-01T19:03:44+00:00

Chuck Ebbert
76306.1226@compuserve.com

2006-04-29T18:07:49+00:00

6584014ec33ed34c5bf6c5af20a0951069bea7a9

The FXSAVE information leak patch introduced a bug in FP exception
handling: it clears FP exceptions only when there are already
none outstanding.  Mikael Pettersson reported that causes problems
with the Erlang runtime and has tested this fix.

Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Acked-by: Mikael Pettersson <mikpe@it.uu.se>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>





The FXSAVE information leak patch introduced a bug in FP exception
handling: it clears FP exceptions only when there are already
none outstanding.  Mikael Pettersson reported that causes problems
with the Erlang runtime and has tested this fix.

Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Acked-by: Mikael Pettersson <mikpe@it.uu.se>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>







[PATCH] MIPS: Fix branch emulation for floating-point exceptions.
2006-05-01T19:03:44+00:00

Win Treese
treese@acm.org

2006-04-26T23:00:04+00:00

a5ddce5373218e73fbd58c20a96edd730048529d

In the branch emulation for floating-point exceptions, __compute_return_epc
must determine for bc1f et al which condition code bit to test. This is
based on bits <4:2> of the rt field. The switch statement to distinguish
bc1f et al needs to use only the two low bits of rt, but the old code tests
on the whole rt field.  This patch masks off the proper bits.

Signed-off-by: Win Treese <treese@acm.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>





In the branch emulation for floating-point exceptions, __compute_return_epc
must determine for bc1f et al which condition code bit to test. This is
based on bits <4:2> of the rt field. The switch statement to distinguish
bc1f et al needs to use only the two low bits of rt, but the old code tests
on the whole rt field.  This patch masks off the proper bits.

Signed-off-by: Win Treese <treese@acm.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>







[PATCH] MIPS: Fix tx49_blast_icache32_page_indexed.
2006-05-01T19:03:44+00:00

Atsushi Nemoto
anemo@mba.ocn.ne.jp

2006-04-26T23:00:03+00:00

2d3b5e296167443bf42c1c962a0cb7ebde9b016b

Fix the cache index value in tx49_blast_icache32_page_indexed().
This is damage by de62893bc0725f8b5f0445250577cd7a10b2d8f8 commit.

Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>





Fix the cache index value in tx49_blast_icache32_page_indexed().
This is damage by de62893bc0725f8b5f0445250577cd7a10b2d8f8 commit.

Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>







[PATCH] MIPS: R2 build fixes for gcc < 3.4.
2006-05-01T19:03:44+00:00

Ralf Baechle
ralf@linux-mips.org

2006-04-26T23:00:02+00:00

ce0bd8e0b232fdf2da9390ad280286f45c5f3a89

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>





Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>







[PATCH] MIPS: Use "R" constraint for cache_op.
2006-05-01T19:03:44+00:00

Ralf Baechle
ralf@linux-mips.org

2006-04-26T23:00:01+00:00

97644aa31cb72ce0e9ebfae27042bc56db672dee

Gcc might emit an absolute address for the the "m" constraint which
gas unfortunately does not permit.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>





Gcc might emit an absolute address for the the "m" constraint which
gas unfortunately does not permit.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>