From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 18 Oct 2013 19:56:09 +0000 (-0700)
Subject: 3.0-stable patches
X-Git-Tag: v3.0.101~1
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ac50f72a0e0dc2c06ba863c0b695e4ea0b0dd4dd;p=thirdparty%2Fkernel%2Fstable-queue.git

3.0-stable patches

added patches:
	ipv6-tcp-fix-panic-in-syn-processing.patch
---

diff --git a/queue-3.0/ipv6-tcp-fix-panic-in-syn-processing.patch b/queue-3.0/ipv6-tcp-fix-panic-in-syn-processing.patch
new file mode 100644
index 00000000000..bded4848ca6
--- /dev/null
+++ b/queue-3.0/ipv6-tcp-fix-panic-in-syn-processing.patch
@@ -0,0 +1,36 @@
+From c16a98ed91597b40b22b540c6517103497ef8e74 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Wed, 23 Nov 2011 15:49:31 -0500
+Subject: ipv6: tcp: fix panic in SYN processing
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit c16a98ed91597b40b22b540c6517103497ef8e74 upstream.
+
+commit 72a3effaf633bc ([NET]: Size listen hash tables using backlog
+hint) added a bug allowing inet6_synq_hash() to return an out of bound
+array index, because of u16 overflow.
+
+Bug can happen if system admins set net.core.somaxconn &
+net.ipv4.tcp_max_syn_backlog sysctls to values greater than 65536
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv6/inet6_connection_sock.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv6/inet6_connection_sock.c
++++ b/net/ipv6/inet6_connection_sock.c
+@@ -85,7 +85,7 @@ struct dst_entry *inet6_csk_route_req(st
+  * request_sock (formerly open request) hash tables.
+  */
+ static u32 inet6_synq_hash(const struct in6_addr *raddr, const __be16 rport,
+-			   const u32 rnd, const u16 synq_hsize)
++			   const u32 rnd, const u32 synq_hsize)
+ {
+ 	u32 c;
+ 
diff --git a/queue-3.0/series b/queue-3.0/series
index 471d3a57a37..9ad4ce4db92 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -4,3 +4,4 @@ ext4-fix-memory-leak-in-xattr.patch
 parisc-fix-interruption-handler-to-respect-pagefault_disable.patch
 watchdog-ts72xx_wdt-locking-bug-in-ioctl.patch
 drm-radeon-fix-hw-contexts-for-sumo2-asics.patch
+ipv6-tcp-fix-panic-in-syn-processing.patch