linux, branch v2.6.16.16

Linux 2.6.16.16

2006-05-11T01:56:24Z

[PATCH] fs/locks.c: Fix lease_init (CVE-2006-1860)

2006-05-11T01:56:15Z

It is insane to be giving lease_init() the task of freeing the lock it is supposed to initialise, given that the lock is not guaranteed to be allocated on the stack. This causes lockups in fcntl_setlease(). Problem diagnosed by Daniel Hokka Zakrisson Also fix a slab leak in __setlease() due to an uninitialised return value. Problem diagnosed by BjÃ¶rn Steinbrink. Signed-off-by: Trond Myklebust Tested-by: Daniel Hokka Zakrisson Signed-off-by: Linus Torvalds Cc: Björn Steinbrink Signed-off-by: Chris Wright

Linux 2.6.16.15

2006-05-09T19:53:30Z

[PATCH] SCTP: Prevent possible infinite recursion with multiple bundled DATA. (CVE-2006-2274)

2006-05-09T19:53:21Z

There is a rare situation that causes lksctp to go into infinite recursion and crash the system. The trigger is a packet that contains at least the first two DATA fragments of a message bundled together. The recursion is triggered when the user data buffer is smaller that the full data message. The problem is that we clone the skb for every fragment in the message. When reassembling the full message, we try to link skbs from the "first fragment" clone using the frag_list. However, since the frag_list is shared between two clones in this rare situation, we end up setting the frag_list pointer of the second fragment to point to itself. This causes sctp_skb_pull() to potentially recurse indefinitely. Proposed solution is to make a copy of the skb when attempting to link things using frag_list. Signed-off-by: Vladislav Yasevich Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller Signed-off-by: Chris Wright

[PATCH] SCTP: Allow spillover of receive buffer to avoid deadlock. (CVE-2006-2275)

2006-05-09T19:53:21Z

This patch fixes a deadlock situation in the receive path by allowing temporary spillover of the receive buffer. - If the chunk we receive has a tsn that immediately follows the ctsn, accept it even if we run out of receive buffer space and renege data with higher TSNs. - Once we accept one chunk in a packet, accept all the remaining chunks even if we run out of receive buffer space. Signed-off-by: Neil Horman Acked-by: Mark Butler Acked-by: Vlad Yasevich Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller Signed-off-by: Chris Wright

[PATCH] SCTP: Fix state table entries for chunks received in CLOSED state. (CVE-2006-2271)

2006-05-09T19:53:20Z

Discard an unexpected chunk in CLOSED state rather can calling BUG(). Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller Signed-off-by: Chris Wright

[PATCH] SCTP: Fix panic's when receiving fragmented SCTP control chunks. (CVE-2006-2272)

2006-05-09T19:53:20Z

Use pskb_pull() to handle incoming COOKIE_ECHO and HEARTBEAT chunks that are received as skb's with fragment list. Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller Signed-off-by: Chris Wright

Linux 2.6.16.14

2006-05-05T00:03:45Z

[PATCH] smbfs chroot issue (CVE-2006-1864)

2006-05-05T00:03:36Z

Mark Moseley reported that a chroot environment on a SMB share can be left via "cd ..\\". Similar to CVE-2006-1863 issue with cifs, this fix is for smbfs. Steven French wrote: Looks fine to me. This should catch the slash on lookup or equivalent, which will be all obvious paths of interest. Signed-off-by: Chris Wright

Linux 2.6.16.13

2006-05-02T21:38:44Z