From: Greg Kroah-Hartman Date: Fri, 4 Dec 2009 05:54:43 +0000 (-0800) Subject: delete .27 patch X-Git-Tag: v2.6.31.7~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=baf69fb98c6c6be1489b64e32c2da44e15bab95f;p=thirdparty%2Fkernel%2Fstable-queue.git delete .27 patch --- diff --git a/queue-2.6.27/ipv4-additional-update-of-dev_net-dev-to-struct-net-in-ip_fragment.c-null-ptr-oops.patch b/queue-2.6.27/ipv4-additional-update-of-dev_net-dev-to-struct-net-in-ip_fragment.c-null-ptr-oops.patch deleted file mode 100644 index 18691c35338..00000000000 --- a/queue-2.6.27/ipv4-additional-update-of-dev_net-dev-to-struct-net-in-ip_fragment.c-null-ptr-oops.patch +++ /dev/null @@ -1,40 +0,0 @@ -From bbf31bf18d34caa87dd01f08bf713635593697f2 Mon Sep 17 00:00:00 2001 -From: David Ford -Date: Sun, 29 Nov 2009 23:02:22 -0800 -Subject: ipv4: additional update of dev_net(dev) to struct *net in ip_fragment.c, NULL ptr OOPS - -From: David Ford - -commit bbf31bf18d34caa87dd01f08bf713635593697f2 upstream. - -ipv4 ip_frag_reasm(), fully replace 'dev_net(dev)' with 'net', defined -previously patched into 2.6.29. - -Between 2.6.28.10 and 2.6.29, net/ipv4/ip_fragment.c was patched, -changing from dev_net(dev) to container_of(...). Unfortunately the goto -section (out_fail) on oversized packets inside ip_frag_reasm() didn't -get touched up as well. Oversized IP packets cause a NULL pointer -dereference and immediate hang. - -I discovered this running openvasd and my previous email on this is -titled: NULL pointer dereference at 2.6.32-rc8:net/ipv4/ip_fragment.c:566 - -Signed-off-by: David Ford -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman - ---- - net/ipv4/ip_fragment.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/net/ipv4/ip_fragment.c -+++ b/net/ipv4/ip_fragment.c -@@ -563,7 +563,7 @@ out_oversize: - "Oversized IP packet from " NIPQUAD_FMT ".\n", - NIPQUAD(qp->saddr)); - out_fail: -- IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMFAILS); -+ IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS); - return err; - } - diff --git a/queue-2.6.27/series b/queue-2.6.27/series index eec9cef1b3f..2bd673df5c8 100644 --- a/queue-2.6.27/series +++ b/queue-2.6.27/series @@ -8,4 +8,3 @@ v4l-dvb-13107-tda18271-fix-overflow-in-fm-radio-frequency-calculation.patch v4l-dvb-13109-tda18271-fix-signedness-issue-in-tda18271_rf_tracking_filters_init.patch v4l-dvb-13190-em28xx-fix-panic-that-can-occur-when-starting-audio-streaming.patch v4l-dvb-13230-s2255drv-don-t-conditionalize-video-buffer-completion-on-waiting-processes.patch -ipv4-additional-update-of-dev_net-dev-to-struct-net-in-ip_fragment.c-null-ptr-oops.patch