.27 patches

diff --git a/queue-2.6.27/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch b/queue-2.6.27/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch
new file mode 100644 (file)
index 0000000..b37247c
--- /dev/null
+++ b/queue-2.6.27/net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch
@@ -0,0 +1,54 @@
+From arjan@infradead.org  Thu Oct  1 11:19:55 2009
+From: Arjan van de Ven <arjan@infradead.org>
+Date: Wed, 30 Sep 2009 13:51:11 +0200
+Subject: net ax25: Fix signed comparison in the sockopt handler
+To: davem@davemloft.net
+Cc: jakub@redhat.com, security@kernel.org, torvalds@linux-foundation.org, mingo@elte.hu, stable@kernel.org
+Message-ID: <20090930135111.64240d86@infradead.org>
+
+
+From: Arjan van de Ven <arjan@linux.intel.com>
+
+fixed upstream in commit b7058842c940ad2c08dd829b21e5c92ebe3b8758 in a different way
+
+The ax25 code tried to use
+
+        if (optlen < sizeof(int))
+                return -EINVAL;
+
+as a security check against optlen being negative (or zero) in the
+set socket option.
+
+Unfortunately, "sizeof(int)" is an unsigned property, with the
+result that the whole comparison is done in unsigned, letting
+negative values slip through.
+
+This patch changes this to
+
+        if (optlen < (int)sizeof(int))
+                return -EINVAL;
+
+so that the comparison is done as signed, and negative values
+get properly caught.
+
+Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ax25/af_ax25.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -539,7 +539,7 @@ static int ax25_setsockopt(struct socket
+       if (level != SOL_AX25)
+               return -ENOPROTOOPT;
+ 
+-      if (optlen < sizeof(int))
++      if (optlen < (int)sizeof(int))
+               return -EINVAL;
+ 
+       if (get_user(opt, (int __user *)optval))

diff --git a/queue-2.6.27/net-make-the-copy-length-in-af_packet-sockopt-handler-unsigned.patch b/queue-2.6.27/net-make-the-copy-length-in-af_packet-sockopt-handler-unsigned.patch
new file mode 100644 (file)
index 0000000..510e695
--- /dev/null
+++ b/queue-2.6.27/net-make-the-copy-length-in-af_packet-sockopt-handler-unsigned.patch
@@ -0,0 +1,48 @@
+From arjan@infradead.org  Thu Oct  1 11:22:25 2009
+From: Arjan van de Ven <arjan@infradead.org>
+Date: Wed, 30 Sep 2009 13:54:47 +0200
+Subject: net: Make the copy length in af_packet sockopt handler unsigned
+To: Arjan van de Ven <arjan@infradead.org>
+Cc: jakub@redhat.com, security@kernel.org, stable@kernel.org, mingo@elte.hu, torvalds@linux-foundation.org, davem@davemloft.net
+Message-ID: <20090930135447.19454507@infradead.org>
+
+
+From: Arjan van de Ven <arjan@linux.intel.com>
+
+fixed upstream in commit b7058842c940ad2c08dd829b21e5c92ebe3b8758 in a different way
+
+The length of the to-copy data structure is currently stored in
+a signed integer. However many comparisons are done with sizeof(..)
+which is unsigned. It's more suitable for this variable to be unsigned
+to make these comparisons more naturally right.
+
+Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/packet/af_packet.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1500,7 +1500,7 @@ packet_setsockopt(struct socket *sock, i
+ static int packet_getsockopt(struct socket *sock, int level, int optname,
+                            char __user *optval, int __user *optlen)
+ {
+-      int len;
++      unsigned int len;
+       int val;
+       struct sock *sk = sock->sk;
+       struct packet_sock *po = pkt_sk(sk);
+@@ -1513,7 +1513,7 @@ static int packet_getsockopt(struct sock
+       if (get_user(len, optlen))
+               return -EFAULT;
+ 
+-      if (len < 0)
++      if ((int)len < 0)
+               return -EINVAL;
+ 
+       switch(optname) {

diff --git a/queue-2.6.27/series b/queue-2.6.27/series
index a1a834fbd83904548b3c3804fa141091e34aa275..4e183873859ae03cef6c5a61fd2f9c183b388757 100644 (file)
--- a/queue-2.6.27/series
+++ b/queue-2.6.27/series
@@ -3,3 +3,5 @@ p54usb-add-zcomax-xg-705a-usbid.patch
 enc28j60-fix-rx-buffer-overflow.patch
 pcnet_cs-fix-misuse-of-the-equality-operator.patch
 fix-incorrect-stable-backport-to-bas_gigaset.patch
+net-ax25-fix-signed-comparison-in-the-sockopt-handler.patch
+net-make-the-copy-length-in-af_packet-sockopt-handler-unsigned.patch