linux-toradex.git, branch v2.6.17.4

Linux 2.6.17.4

2006-07-06T20:02:28+00:00

fix prctl privilege escalation and suid_dumpable (CVE-2006-2451)

2006-07-06T20:02:05+00:00

Based on a patch from Ernie Petrides

During security research, Red Hat discovered a behavioral flaw in core
dump handling. A local user could create a program that would cause a
core file to be dumped into a directory they would not normally have
permissions to write to. This could lead to a denial of service (disk
consumption), or allow the local user to gain root privileges.

Signed-off-by: Greg Kroah-Hartman

Linux 2.6.17.3

2006-06-30T17:37:38+00:00

[PATCH] NETFILTER: SCTP conntrack: fix crash triggered by packet without chunks [CVE-2006-2934]

2006-06-30T17:37:31+00:00

When a packet without any chunks is received, the newconntrack variable
in sctp_packet contains an out of bounds value that is used to look up an
pointer from the array of timeouts, which is then dereferenced, resulting
in a crash. Make sure at least a single chunk is present.

Problem noticed by George A. Theall 

Signed-off-by: Patrick McHardy 
Signed-off-by: Chris Wright

Linux 2.6.17.2

2006-06-30T00:17:23+00:00

[PATCH] Input: return correct size when reading modalias attribute

2006-06-30T00:17:17+00:00

Input: return correct size when reading modalias attribute

Signed-off-by: Richard Purdie 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Chris Wright

[PATCH] idr: fix race in idr code

2006-06-30T00:17:17+00:00

From: Sonny Rao 

I ran into a bug where the kernel died in the idr code:

cpu 0x1d: Vector: 300 (Data Access) at [c000000b7096f710]
    pc: c0000000001f8984: .idr_get_new_above_int+0x140/0x330
    lr: c0000000001f89b4: .idr_get_new_above_int+0x170/0x330
    sp: c000000b7096f990
   msr: 800000000000b032
   dar: 0
 dsisr: 40010000
  current = 0xc000000b70d43830
  paca    = 0xc000000000556900
    pid   = 2022, comm = hwup
1d:mon> t
[c000000b7096f990] c0000000000d2ad8 .expand_files+0x2e8/0x364 (unreliable)
[c000000b7096faa0] c0000000001f8bf8 .idr_get_new_above+0x18/0x68
[c000000b7096fb20] c00000000002a054 .init_new_context+0x5c/0xf0
[c000000b7096fbc0] c000000000049dc8 .copy_process+0x91c/0x1404
[c000000b7096fcd0] c00000000004a988 .do_fork+0xd8/0x224
[c000000b7096fdc0] c00000000000ebdc .sys_clone+0x5c/0x74
[c000000b7096fe30] c000000000008950 .ppc_clone+0x8/0xc
-- Exception: c00 (System Call) at 000000000fde887c
SP (f8b4e7a0) is in userspace

Turned out to be a race-condition and NULL ptr deref, here's my fix:

Users of the idr code are supposed to call idr_pre_get without locking, so the
idr code must serialize itself with respect to layer allocations.  However, it
fails to do so in an error path in idr_get_new_above_int().  I added the
missing locking to fix this.

Signed-off-by: Sonny Rao 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Chris Wright

[PATCH] Link error when futexes are disabled on 64bit architectures

2006-06-30T00:17:17+00:00

From: Anton Blanchard 

If futexes are disabled we fail to link on ppc64.

Signed-off-by: Anton Blanchard 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Chris Wright

[PATCH] kbuild: bugfix with initramfs

2006-06-30T00:17:17+00:00

This patch fix double inclusion of ramfs-input.

Signed-off-by: Nickolay Vinogradov 
Signed-off-by: Sam Ravnborg 
Signed-off-by: Chris Wright

[PATCH] ide-io: increase timeout value to allow for slave wakeup

2006-06-30T00:17:16+00:00

During an STR resume cycle, the ide master disk times-out when there is
also a slave present (especially CD).  Increasing the timeout in ide-io
from 10,000 to 100,000 fixes this problem.

Acked-by: Alan Cox 
Cc: Bartlomiej Zolnierkiewicz 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Chris Wright