linux-toradex.git, branch v2.6.16.5

Linux 2.6.16.5

2006-04-12T20:27:57+00:00

[PATCH] x86_64: When user could have changed RIP always force IRET (CVE-2006-0744)

2006-04-12T20:06:54+00:00

Intel EM64T CPUs handle uncanonical return addresses differently from
AMD CPUs.

The exception is reported in the SYSRET, not the next instruction.
Thgis leads to the kernel exception handler running on the user stack
with the wrong GS because the kernel didn't expect exceptions on this
instruction.

This version of the patch has the teething problems that plagued an
earlier version fixed.

This is CVE-2006-0744

Thanks to Ernie Petrides and Asit B. Mallick for analysis and initial
patches.

Signed-off-by: Andi Kleen 
Signed-off-by: Greg Kroah-Hartman

[PATCH] x86_64: Clean up execve

2006-04-12T20:06:53+00:00

Just call IRET always, no need for any special cases.

Needed for the next bug fix.

Signed-off-by: Andi Kleen 
Signed-off-by: Greg Kroah-Hartman

Linux 2.6.16.4

2006-04-11T17:19:28+00:00

[PATCH] RCU signal handling

2006-04-11T16:46:41+00:00

made this BUG_ON() unsafe. This code runs under ->siglock,
while switch_exec_pids() takes tasklist_lock.

Signed-off-by: Oleg Nesterov 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Linux 2.6.16.3

2006-04-11T05:27:44+00:00

[PATCH] Keys: Fix oops when adding key to non-keyring [CVE-2006-1522]

2006-04-11T04:48:21+00:00

This fixes the problem of an oops occuring when a user attempts to add a
key to a non-keyring key [CVE-2006-1522].

The problem is that __keyring_search_one() doesn't check that the
keyring it's been given is actually a keyring.

I've fixed this problem by:

 (1) declaring that caller of __keyring_search_one() must guarantee that
     the keyring is a keyring; and

 (2) making key_create_or_update() check that the keyring is a keyring,
     and return -ENOTDIR if it isn't.

This can be tested by:

	keyctl add user b b `keyctl add user a a @s`

Signed-off-by: David Howells 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Linux 2.6.16.2

2006-04-07T16:56:47+00:00

[PATCH] kdump proc vmcore size oveflow fix

2006-04-07T16:44:30+00:00

A couple of /proc/vmcore data structures overflow with 32bit systems having
memory more than 4G.  This patch fixes those.

Signed-off-by: Ken'ichi Ohmichi 
Signed-off-by: Vivek Goyal 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

[PATCH] knfsd: Correct reserved reply space for read requests.

2006-04-07T16:44:30+00:00

NFSd makes sure there is enough space to hold the maximum possible reply
before accepting a request.  The units for this maximum is (4byte) words.
However in three places, particularly for read request, the number given is
a number of bytes.

This means too much space is reserved which is slightly wasteful.

This is the sort of patch that could uncover a deeper bug, and it is not
critical, so it would be best for it to spend a while in -mm before going
in to mainline.

(akpm: target 2.6.17-rc2, 2.6.16.3 (approx))

Discovered-by: "Eivind  Sarto" 
Signed-off-by: Neil Brown 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman