linux-toradex.git/net, branch v2.6.27.57

econet: fix CVE-2010-3850

2010-12-09T21:24:21+00:00

commit 16c41745c7b92a243d0874f534c1655196c64b74 upstream.

Add missing check for capable(CAP_NET_ADMIN) in SIOCSIFADDR operation.

Signed-off-by: Phil Blundell 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849

2010-12-09T21:24:21+00:00

commit fa0e846494792e722d817b9d3d625a4ef4896c96 upstream.

Later parts of econet_sendmsg() rely on saddr != NULL, so return early
with EINVAL if NULL was passed otherwise an oops may occur.

Signed-off-by: Phil Blundell 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

x25: Prevent crashing when parsing bad X.25 facilities

2010-12-09T21:24:21+00:00

commit 5ef41308f94dcbb3b7afc56cdef1c2ba53fa5d2f upstream.

Now with improved comma support.

On parsing malformed X.25 facilities, decrementing the remaining length
may cause it to underflow.  Since the length is an unsigned integer,
this will result in the loop continuing until the kernel crashes.

This patch adds checks to ensure decrementing the remaining length does
not cause it to wrap around.

Signed-off-by: Dan Rosenberg 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

can-bcm: fix minor heap overflow

2010-12-09T21:24:21+00:00

commit 0597d1b99fcfc2c0eada09a698f85ed413d4ba84 upstream.

On 64-bit platforms the ASCII representation of a pointer may be up to 17
bytes long. This patch increases the length of the buffer accordingly.

http://marc.info/?l=linux-netdev&m=128872251418192&w=2

Reported-by: Dan Rosenberg 
Signed-off-by: Oliver Hartkopp 
CC: Linus Torvalds 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

memory corruption in X.25 facilities parsing

2010-12-09T21:24:21+00:00

commit a6331d6f9a4298173b413cf99a40cc86a9d92c37 upstream.

Signed-of-by: Andrew Hendry 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

x25: Patch to fix bug 15678 - x25 accesses fields beyond end of packet.

2010-12-09T21:24:20+00:00

commit f5eb917b861828da18dc28854308068c66d1449a upstream.

Here is a patch to stop X.25 examining fields beyond the end of the packet.

For example, when a simple CALL ACCEPTED was received:

	10 10 0f

x25_parse_facilities was attempting to decode the FACILITIES field, but this
packet contains no facilities field.

Signed-off-by: John Hughes 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ipv6: conntrack: Add member of user to nf_ct_frag6_queue structure

2010-12-09T21:24:20+00:00

commit c92b544bd5d8e7ed7d81c77bbecab6df2a95aa53 upstream.

The commit 0b5ccb2(title:ipv6: reassembly: use seperate reassembly queues for
conntrack and local delivery) has broken the saddr&&daddr member of
nf_ct_frag6_queue when creating new queue.  And then hash value
generated by nf_hashfn() was not equal with that generated by fq_find().
So, a new received fragment can't be inserted to right queue.

The patch fixes the bug with adding member of user to nf_ct_frag6_queue structure.

Signed-off-by: Shan Wei 
Acked-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Cc: Pascal Hambourg 
Signed-off-by: Greg Kroah-Hartman

net: Truncate recvfrom and sendto length to INT_MAX.

2010-12-09T21:24:20+00:00

commit 253eacc070b114c2ec1f81b067d2fed7305467b0 upstream.

Signed-off-by: Linus Torvalds 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

tcp: Fix race in tcp_poll

2010-12-09T21:24:20+00:00

[ Upstream commit a4d258036ed9b2a1811c3670c6099203a0f284a0 ]

If a RST comes in immediately after checking sk->sk_err, tcp_poll will
return POLLIN but not POLLOUT.  Fix this by checking sk->sk_err at the end
of tcp_poll.  Additionally, ensure the correct order of operations on SMP
machines with memory barriers.

Signed-off-by: Tom Marshall 
Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

Limit sysctl_tcp_mem and sysctl_udp_mem initializers to prevent integer overflows.

2010-12-09T21:24:20+00:00

[ Upstream fixed this in a different way as parts of the commits:
	8d987e5c7510 (net: avoid limits overflow)
	a9febbb4bd13 (sysctl: min/max bounds are optional)
	27b3d80a7b6a (sysctl: fix min/max handling in __do_proc_doulongvec_minmax())
 -DaveM ]
 
On a 16TB x86_64 machine, sysctl_tcp_mem[2], sysctl_udp_mem[2], and
sysctl_sctp_mem[2] can integer overflow.  Set limit such that they are
maximized without overflowing.

Signed-off-by: Robin Holt 
To: "David S. Miller" 
Cc: Willy Tarreau 
Cc: linux-kernel@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-sctp@vger.kernel.org
Cc: Alexey Kuznetsov 
Cc: "Pekka Savola (ipv6)" 
Cc: James Morris 
Cc: Hideaki YOSHIFUJI 
Cc: Patrick McHardy 
Cc: Vlad Yasevich 
Cc: Sridhar Samudrala 
Signed-off-by: Greg Kroah-Hartman