From: Greg Kroah-Hartman Date: Thu, 1 Oct 2009 18:29:29 +0000 (-0700) Subject: .31 patches X-Git-Tag: v2.6.27.36~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f559c4f5b0cbed0513688a3de13c0c31b80729bd;p=thirdparty%2Fkernel%2Fstable-queue.git .31 patches --- diff --git a/queue-2.6.31/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch b/queue-2.6.31/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch new file mode 100644 index 00000000000..4151810beb0 --- /dev/null +++ b/queue-2.6.31/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch @@ -0,0 +1,54 @@ +From arjan@infradead.org Thu Oct 1 11:19:55 2009 +From: Arjan van de Ven +Date: Wed, 30 Sep 2009 13:51:11 +0200 +Subject: net ax25: Fix signed comparison in the sockopt handler +To: davem@davemloft.net +Cc: jakub@redhat.com, security@kernel.org, torvalds@linux-foundation.org, mingo@elte.hu, stable@kernel.org +Message-ID: <20090930135111.64240d86@infradead.org> + + +From: Arjan van de Ven + +fixed upstream in commit b7058842c940ad2c08dd829b21e5c92ebe3b8758 in a different way + +The ax25 code tried to use + + if (optlen < sizeof(int)) + return -EINVAL; + +as a security check against optlen being negative (or zero) in the +set socket option. + +Unfortunately, "sizeof(int)" is an unsigned property, with the +result that the whole comparison is done in unsigned, letting +negative values slip through. + +This patch changes this to + + if (optlen < (int)sizeof(int)) + return -EINVAL; + +so that the comparison is done as signed, and negative values +get properly caught. + +Signed-off-by: Arjan van de Ven +Cc: David S. Miller +Cc: Ingo Molnar +Cc: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + net/ax25/af_ax25.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ax25/af_ax25.c ++++ b/net/ax25/af_ax25.c +@@ -538,7 +538,7 @@ static int ax25_setsockopt(struct socket + if (level != SOL_AX25) + return -ENOPROTOOPT; + +- if (optlen < sizeof(int)) ++ if (optlen < (int)sizeof(int)) + return -EINVAL; + + if (get_user(opt, (int __user *)optval)) diff --git a/queue-2.6.31/net-make-the-copy-length-in-af_packet-sockopt-handler-unsigned.patch b/queue-2.6.31/net-make-the-copy-length-in-af_packet-sockopt-handler-unsigned.patch new file mode 100644 index 00000000000..43f2b965580 --- /dev/null +++ b/queue-2.6.31/net-make-the-copy-length-in-af_packet-sockopt-handler-unsigned.patch @@ -0,0 +1,48 @@ +From arjan@infradead.org Thu Oct 1 11:22:25 2009 +From: Arjan van de Ven +Date: Wed, 30 Sep 2009 13:54:47 +0200 +Subject: net: Make the copy length in af_packet sockopt handler unsigned +To: Arjan van de Ven +Cc: jakub@redhat.com, security@kernel.org, stable@kernel.org, mingo@elte.hu, torvalds@linux-foundation.org, davem@davemloft.net +Message-ID: <20090930135447.19454507@infradead.org> + + +From: Arjan van de Ven + +fixed upstream in commit b7058842c940ad2c08dd829b21e5c92ebe3b8758 in a different way + +The length of the to-copy data structure is currently stored in +a signed integer. However many comparisons are done with sizeof(..) +which is unsigned. It's more suitable for this variable to be unsigned +to make these comparisons more naturally right. + +Signed-off-by: Arjan van de Ven +Cc: David S. Miller +Cc: Ingo Molnar +Cc: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + net/packet/af_packet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1836,7 +1836,7 @@ packet_setsockopt(struct socket *sock, i + static int packet_getsockopt(struct socket *sock, int level, int optname, + char __user *optval, int __user *optlen) + { +- int len; ++ unsigned int len; + int val; + struct sock *sk = sock->sk; + struct packet_sock *po = pkt_sk(sk); +@@ -1849,7 +1849,7 @@ static int packet_getsockopt(struct sock + if (get_user(len, optlen)) + return -EFAULT; + +- if (len < 0) ++ if ((int)len < 0) + return -EINVAL; + + switch (optname) { diff --git a/queue-2.6.31/series b/queue-2.6.31/series index ff6c6fa1955..4e33e214f05 100644 --- a/queue-2.6.31/series +++ b/queue-2.6.31/series @@ -67,3 +67,5 @@ nfsd4-fix-null-dereference-creating-nfsv4-callback-client.patch can-fix-nohz-local_softirq_pending-08-warning.patch ahci-restore-pci_intx-handling.patch pxa-sharpsl_pm-zaurus-c3000-aka-spitz-fix-resume.patch +net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch +net-make-the-copy-length-in-af_packet-sockopt-handler-unsigned.patch