linux-toradex.git, branch v2.6.16.24

Linux 2.6.16.24

2006-07-06T20:06:01+00:00

fix prctl privilege escalation and suid_dumpable (CVE-2006-2451)

2006-07-06T20:05:42+00:00

Based on a patch from Ernie Petrides

During security research, Red Hat discovered a behavioral flaw in core
dump handling. A local user could create a program that would cause a
core file to be dumped into a directory they would not normally have
permissions to write to. This could lead to a denial of service (disk
consumption), or allow the local user to gain root privileges.

Signed-off-by: Greg Kroah-Hartman

Linux 2.6.16.23

2006-06-30T21:17:30+00:00

[PATCH] revert PARPORT_SERIAL should depend on SERIAL_8250_PCI patch

2006-06-30T21:06:52+00:00

Should have not been applied to 2.6.16

Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] NETFILTER: SCTP conntrack: fix crash triggered by packet without chunks [CVE-2006-2934]

2006-06-30T21:06:52+00:00

When a packet without any chunks is received, the newconntrack variable
in sctp_packet contains an out of bounds value that is used to look up an
pointer from the array of timeouts, which is then dereferenced, resulting
in a crash. Make sure at least a single chunk is present.

Problem noticed by George A. Theall 

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

Linux 2.6.16.22

2006-06-22T19:16:21+00:00

[PATCH] NTFS: Critical bug fix (affects MIPS and possibly others)

2006-06-22T19:16:12+00:00

It fixes a crash in NTFS on architectures where flush_dcache_page()
is a real function.  I never noticed this as all my testing is done on
i386 where flush_dcache_page() is NULL.

http://bugzilla.kernel.org/show_bug.cgi?id=6700

Many thanks to Pauline Ng for the detailed bug report and analysis!

Signed-off-by: Anton Altaparmakov 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Chris Wright

[PATCH] powernow-k8 crash workaround

2006-06-22T19:16:12+00:00

Work around the oops reported in
http://bugzilla.kernel.org/show_bug.cgi?id=6478.

Thanks to Ralf Hildebrandt  for testing and
reporting.

Acked-by: Dave Jones 
Cc: "Brown, Len" 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] I2O: Bugfixes to get I2O working again

2006-06-22T19:16:12+00:00

- Fixed locking of struct i2o_exec_wait in Executive-OSM

- Removed LCT Notify in i2o_exec_probe() which caused freeing memory and
  accessing freed memory during first enumeration of I2O devices

- Added missing locking in i2o_exec_lct_notify()

- removed put_device() of I2O controller in i2o_iop_remove() which caused
  the controller structure get freed to early

- Fixed size of mempool in i2o_iop_alloc()

- Fixed access to freed memory in i2o_msg_get()

See http://bugzilla.kernel.org/show_bug.cgi?id=6561

Signed-off-by: Markus Lidel 
Signed-off-by: Andrew Morton 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] scsi_lib.c: properly count the number of pages in scsi_req_map_sg()

2006-06-22T19:16:12+00:00

The calculation of nr_pages in scsi_req_map_sg() doesn't account for
the fact that the first page could have an offset that pushes the end
of the buffer onto a new page.

Signed-off-by: Bryan Holty 
Signed-off-by: James Bottomley 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman