.25 patch

diff --git a/queue-2.6.25/dccp-change-l-r-must-have-at-least-one-byte-in-the-dccpsf_val-field.patch b/queue-2.6.25/dccp-change-l-r-must-have-at-least-one-byte-in-the-dccpsf_val-field.patch
new file mode 100644 (file)
index 0000000..9d9310d
--- /dev/null
+++ b/queue-2.6.25/dccp-change-l-r-must-have-at-least-one-byte-in-the-dccpsf_val-field.patch
@@ -0,0 +1,35 @@
+From 3e8a0a559c66ee9e7468195691a56fefc3589740 Mon Sep 17 00:00:00 2001
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date: Wed, 13 Aug 2008 13:48:39 -0700
+Subject: dccp: change L/R must have at least one byte in the dccpsf_val field
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+commit 3e8a0a559c66ee9e7468195691a56fefc3589740 upstream
+
+Thanks to Eugene Teo for reporting this problem.
+
+Signed-off-by: Eugene Teo <eugenete@kernel.sg>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/dccp/proto.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -477,6 +477,11 @@ static int dccp_setsockopt_change(struct
+ 
+       if (copy_from_user(&opt, optval, sizeof(opt)))
+               return -EFAULT;
++      /*
++       * rfc4340: 6.1. Change Options
++       */
++      if (opt.dccpsf_len < 1)
++              return -EINVAL;
+ 
+       val = kmalloc(opt.dccpsf_len, GFP_KERNEL);
+       if (!val)

diff --git a/queue-2.6.25/series b/queue-2.6.25/series
index 58171db732942c1389c455a7b4476dd48b6dbf97..55a9c5bc4bda643b83c427798b1235e503e06d40 100644 (file)
--- a/queue-2.6.25/series
+++ b/queue-2.6.25/series
@@ -19,3 +19,4 @@ ide-cd-fix-endianity-for-the-error-message-in-cdrom_read_capacity.patch
 cifs-mount-of-ipc-breaks-with-iget-patch.patch
 cifs-if-get-root-inode-fails-during-mount-cleanup-tree-connection.patch
 acer-wmi-fix-wireless-and-bluetooth-on-early-amw0-v2-laptops.patch
+dccp-change-l-r-must-have-at-least-one-byte-in-the-dccpsf_val-field.patch