linux-toradex.git/net/ipv4, branch v2.6.16.15

[PATCH] NETFILTER: SCTP conntrack: fix infinite loop (CVE-2006-1527)

2006-05-02T21:38:21+00:00

[NETFILTER]: SCTP conntrack: fix infinite loop

fix infinite loop in the SCTP-netfilter code: check SCTP chunk size to
guarantee progress of for_each_sctp_chunk(). (all other uses of
for_each_sctp_chunk() are preceded by do_basic_checks(), so this fix
should be complete.)

Based on patch from Ingo Molnar 

Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix truesize underflow

2006-04-24T16:56:03+00:00

[TCP]: Fix truesize underflow

There is a problem with the TSO packet trimming code.  The cause of
this lies in the tcp_fragment() function.

When we allocate a fragment for a completely non-linear packet the
truesize is calculated for a payload length of zero.  This means that
truesize could in fact be less than the real payload length.

When that happens the TSO packet trimming can cause truesize to become
negative.  This in turn can cause sk_forward_alloc to be -n * PAGE_SIZE
which would trigger the warning.

I've copied the code DaveM used in tso_fragment which should work here.

Signed-off-by: Herbert Xu 
Signed-off-by: David Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] ip_route_input panic fix (CVE-2006-1525)

2006-04-18T21:31:47+00:00

This fixes http://bugzilla.kernel.org/show_bug.cgi?id=6388
The bug is caused by ip_route_input dereferencing skb->nh.protocol of
the dummy skb passed dow from inet_rtm_getroute (Thanks Thomas for seeing
it). It only happens if the route requested is for a multicast IP
address.

Signed-off-by: Stephen Hemminger 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] NETFILTER: Fix fragmentation issues with bridge netfilter

2006-04-17T20:16:04+00:00

[NETFILTER]: Fix fragmentation issues with bridge netfilter

The conntrack code doesn't do re-fragmentation of defragmented packets
anymore but relies on fragmentation in the IP layer. Purely bridged
packets don't pass through the IP layer, so the bridge netfilter code
needs to take care of fragmentation itself.

Signed-off-by: Patrick McHardy 
Signed-off-by: Greg Kroah-Hartman

[PATCH] fib_trie.c node freeing fix

2006-04-07T16:44:29+00:00

Please apply to 2.6.{14,15,16} -stable, thanks a lot.

From: Robert Olsson 

[FIB_TRIE]: Fix leaf freeing.

Seems like leaf (end-nodes) has been freed by __tnode_free_rcu and not
by __leaf_free_rcu. This fixes the problem. Only tnode_free is now
used which checks for appropriate node type. free_leaf can be removed.

Signed-off-by: Robert Olsson 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] {ip, nf}_conntrack_netlink: fix expectation notifier unregistration

2006-04-07T16:44:28+00:00

[NETFILTER]: {ip,nf}_conntrack_netlink: fix expectation notifier unregistration

This patch fixes expectation notifier unregistration on module unload to
use ip_conntrack_expect_unregister_notifier(). This bug causes a soft
lockup at the first expectation created after a rmmod ; insmod of this
module.

Should go into -stable as well.

Signed-off-by: Martin Josefsson 
Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

[PATCH] TCP: Do not use inet->id of global tcp_socket when sending RST (CVE-2006-1242)

2006-03-28T06:47:30+00:00

The problem is in ip_push_pending_frames(), which uses:

        if (!df) {
                __ip_select_ident(iph, &rt->u.dst, 0);
        } else {
                iph->id = htons(inet->id++);
        }

instead of ip_select_ident().

Right now I think the code is a nonsense. Most likely, I copied it from
old ip_build_xmit(), where it was really special, we had to decide
whether to generate unique ID when generating the first (well, the last)
fragment.

In ip_push_pending_frames() it does not make sense, it should use plain
ip_select_ident() instead.

Signed-off-by: Alexey Kuznetsov 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[NETFILTER]: arp_tables: fix NULL pointer dereference

2006-03-13T04:40:43+00:00

The check is wrong and lets NULL-ptrs slip through since !IS_ERR(NULL)
is true.

Coverity #190

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[IPV4/6]: Fix UFO error propagation

2006-03-13T04:39:40+00:00

When ufo_append_data fails err is uninitialized, but returned back.
Strangely gcc doesn't notice it.

Coverity #901 and #902

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller

[TCP]: tcp_highspeed: fix AIMD table out-of-bounds access

2006-03-13T04:39:39+00:00

Covertiy #547

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller