.27 patch

diff --git a/queue-2.6.27/sctp-fix-append-error-cause-to-error-chunk-correctly.patch b/queue-2.6.27/sctp-fix-append-error-cause-to-error-chunk-correctly.patch
new file mode 100644 (file)
index 0000000..8b3511f
--- /dev/null
+++ b/queue-2.6.27/sctp-fix-append-error-cause-to-error-chunk-correctly.patch
@@ -0,0 +1,46 @@
+From 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+Date: Mon, 17 May 2010 22:51:58 -0700
+Subject: sctp: fix append error cause to ERROR chunk correctly
+
+From: Wei Yongjun <yjwei@cn.fujitsu.com>
+
+commit 2e3219b5c8a2e44e0b83ae6e04f52f20a82ac0f2 upstream.
+
+commit 5fa782c2f5ef6c2e4f04d3e228412c9b4a4c8809
+  sctp: Fix skb_over_panic resulting from multiple invalid \
+    parameter errors (CVE-2010-1173) (v4)
+
+cause 'error cause' never be add the the ERROR chunk due to
+some typo when check valid length in sctp_init_cause_fixed().
+
+Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
+Reviewed-by: Neil Horman <nhorman@tuxdriver.com>
+Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sctp/sm_make_chunk.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -140,7 +140,7 @@ int sctp_init_cause_fixed(struct sctp_ch
+       len = sizeof(sctp_errhdr_t) + paylen;
+       err.length  = htons(len);
+ 
+-      if (skb_tailroom(chunk->skb) >  len)
++      if (skb_tailroom(chunk->skb) < len)
+               return -ENOSPC;
+       chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
+                                                    sizeof(sctp_errhdr_t),
+@@ -1401,7 +1401,7 @@ void *sctp_addto_chunk(struct sctp_chunk
+ void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
+                            int len, const void *data)
+ {
+-      if (skb_tailroom(chunk->skb) > len)
++      if (skb_tailroom(chunk->skb) >= len)
+               return sctp_addto_chunk(chunk, len, data);
+       else
+               return NULL;

diff --git a/queue-2.6.27/series b/queue-2.6.27/series
index 0bbf3de9a8c725730fbefb7d29e95603c3134f16..2511321066d09ff756de4688a38231bd79109512 100644 (file)
--- a/queue-2.6.27/series
+++ b/queue-2.6.27/series
@@ -20,3 +20,4 @@ tipc-fix-oops-on-send-prior-to-entering-networked-mode-v3.patch
 parisc-clear-floating-point-exception-flag-on-sigfpe-signal.patch
 keys-return-more-accurate-error-codes.patch
 keys-find_keyring_by_name-can-gain-access-to-a-freed-keyring.patch
+sctp-fix-append-error-cause-to-error-chunk-correctly.patch