linux-toradex.git, branch v2.6.27.57

Linux 2.6.27.57

2010-12-09T21:24:40+00:00

econet: fix CVE-2010-3850

2010-12-09T21:24:21+00:00

commit 16c41745c7b92a243d0874f534c1655196c64b74 upstream.

Add missing check for capable(CAP_NET_ADMIN) in SIOCSIFADDR operation.

Signed-off-by: Phil Blundell 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849

2010-12-09T21:24:21+00:00

commit fa0e846494792e722d817b9d3d625a4ef4896c96 upstream.

Later parts of econet_sendmsg() rely on saddr != NULL, so return early
with EINVAL if NULL was passed otherwise an oops may occur.

Signed-off-by: Phil Blundell 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

x25: Prevent crashing when parsing bad X.25 facilities

2010-12-09T21:24:21+00:00

commit 5ef41308f94dcbb3b7afc56cdef1c2ba53fa5d2f upstream.

Now with improved comma support.

On parsing malformed X.25 facilities, decrementing the remaining length
may cause it to underflow.  Since the length is an unsigned integer,
this will result in the loop continuing until the kernel crashes.

This patch adds checks to ensure decrementing the remaining length does
not cause it to wrap around.

Signed-off-by: Dan Rosenberg 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

V4L/DVB: ivtvfb: prevent reading uninitialized stack memory

2010-12-09T21:24:21+00:00

commit 405707985594169cfd0b1d97d29fcb4b4c6f2ac9 upstream.

The FBIOGET_VBLANK device ioctl allows unprivileged users to read 16
bytes of uninitialized stack memory, because the "reserved" member of
the fb_vblank struct declared on the stack is not altered or zeroed
before being copied back to the user.  This patch takes care of it.

Signed-off-by: Dan Rosenberg 
Signed-off-by: Andy Walls 
Signed-off-by: Mauro Carvalho Chehab 
Signed-off-by: Greg Kroah-Hartman

can-bcm: fix minor heap overflow

2010-12-09T21:24:21+00:00

commit 0597d1b99fcfc2c0eada09a698f85ed413d4ba84 upstream.

On 64-bit platforms the ASCII representation of a pointer may be up to 17
bytes long. This patch increases the length of the buffer accordingly.

http://marc.info/?l=linux-netdev&m=128872251418192&w=2

Reported-by: Dan Rosenberg 
Signed-off-by: Oliver Hartkopp 
CC: Linus Torvalds 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

memory corruption in X.25 facilities parsing

2010-12-09T21:24:21+00:00

commit a6331d6f9a4298173b413cf99a40cc86a9d92c37 upstream.

Signed-of-by: Andrew Hendry 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

x25: Patch to fix bug 15678 - x25 accesses fields beyond end of packet.

2010-12-09T21:24:20+00:00

commit f5eb917b861828da18dc28854308068c66d1449a upstream.

Here is a patch to stop X.25 examining fields beyond the end of the packet.

For example, when a simple CALL ACCEPTED was received:

	10 10 0f

x25_parse_facilities was attempting to decode the FACILITIES field, but this
packet contains no facilities field.

Signed-off-by: John Hughes 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ipv6: conntrack: Add member of user to nf_ct_frag6_queue structure

2010-12-09T21:24:20+00:00

commit c92b544bd5d8e7ed7d81c77bbecab6df2a95aa53 upstream.

The commit 0b5ccb2(title:ipv6: reassembly: use seperate reassembly queues for
conntrack and local delivery) has broken the saddr&&daddr member of
nf_ct_frag6_queue when creating new queue.  And then hash value
generated by nf_hashfn() was not equal with that generated by fq_find().
So, a new received fragment can't be inserted to right queue.

The patch fixes the bug with adding member of user to nf_ct_frag6_queue structure.

Signed-off-by: Shan Wei 
Acked-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Cc: Pascal Hambourg 
Signed-off-by: Greg Kroah-Hartman

net: Truncate recvfrom and sendto length to INT_MAX.

2010-12-09T21:24:20+00:00

commit 253eacc070b114c2ec1f81b067d2fed7305467b0 upstream.

Signed-off-by: Linus Torvalds 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman