linux/net, branch v2.6.26.4

sunrpc: fix possible overrun on read of /proc/sys/sunrpc/transports

2008-09-08T11:44:30Z

commit 27df6f25ff218072e0e879a96beeb398a79cdbc8 upstream Vegard Nossum reported ---------------------- > I noticed that something weird is going on with /proc/sys/sunrpc/transports. > This file is generated in net/sunrpc/sysctl.c, function proc_do_xprt(). When > I "cat" this file, I get the expected output: > $ cat /proc/sys/sunrpc/transports > tcp 1048576 > udp 32768 > But I think that it does not check the length of the buffer supplied by > userspace to read(). With my original program, I found that the stack was > being overwritten by the characters above, even when the length given to > read() was just 1. David Wagner added (among other things) that copy_to_user could be probably used here. Ingo Oeser suggested to use simple_read_from_buffer() here. The conclusion is that proc_do_xprt doesn't check for userside buffer size indeed so fix this by using Ingo's suggestion. Reported-by: Vegard Nossum Signed-off-by: Cyrill Gorcunov CC: Ingo Oeser Cc: Neil Brown Cc: Chuck Lever Cc: Greg Banks Cc: Tom Tucker Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman

ipsec: Fix deadlock in xfrm_state management.

2008-09-08T11:44:29Z

[ Upstream commit 37b08e34a98c664bea86e3fae718ac45a46b7276 ] Ever since commit 4c563f7669c10a12354b72b518c2287ffc6ebfb3 ("[XFRM]: Speed up xfrm_policy and xfrm_state walking") it is illegal to call __xfrm_state_destroy (and thus xfrm_state_put()) with xfrm_state_lock held. If we do, we'll deadlock since we have the lock already and __xfrm_state_destroy() tries to take it again. Fix this by pushing the xfrm_state_put() calls after the lock is dropped. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

sctp: fix random memory dereference with SCTP_HMAC_IDENT option.

2008-09-08T11:44:25Z

[ Upstream commit d97240552cd98c4b07322f30f66fd9c3ba4171de ] The number of identifiers needs to be checked against the option length. Also, the identifier index provided needs to be verified to make sure that it doesn't exceed the bounds of the array. Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

sctp: correct bounds check in sctp_setsockopt_auth_key

2008-09-08T11:44:25Z

[ Upstream commit 328fc47ea0bcc27d9afa69c3ad6e52431cadd76c ] The bonds check to prevent buffer overlflow was not exactly right. It still allowed overflow of up to 8 bytes which is sizeof(struct sctp_authkey). Since optlen is already checked against the size of that struct, we are guaranteed not to cause interger overflow either. Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

sch_prio: Fix nla_parse_nested_compat() regression

2008-09-08T11:44:25Z

[ No upstream commit, this is fixing code no longer in 2.6.27 ] nla_parse_nested_compat() was used to parse two different message formats in the netem and prio qdisc, when it was "fixed" to work with netem, it broke the multi queue support in the prio qdisc. Since the prio qdisc code in question is already removed in the development tree, this patch only fixes the regression in the stable tree. Based on original patch from Alexander H Duyck Signed-off-by: Thomas Graf Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

sctp: add verification checks to SCTP_AUTH_KEY option

2008-09-08T11:44:24Z

[ Upstream commit 30c2235cbc477d4629983d440cdc4f496fec9246 ] The structure used for SCTP_AUTH_KEY option contains a length that needs to be verfied to prevent buffer overflow conditions. Spoted by Eugene Teo . Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller Acked-by: Eugene Teo Signed-off-by: Greg Kroah-Hartman

sctp: fix potential panics in the SCTP-AUTH API.

2008-09-08T11:44:24Z

[ Upstream commit 5e739d1752aca4e8f3e794d431503bfca3162df4 ] All of the SCTP-AUTH socket options could cause a panic if the extension is disabled and the API is envoked. Additionally, there were some additional assumptions that certain pointers would always be valid which may not always be the case. This patch hardens the API and address all of the crash scenarios. Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

udp: Drop socket lock for encapsulated packets

2008-09-08T11:44:24Z

[ Upstream commit d97106ea52aa57e63ff40d04479016836bbb5a4e ] The socket lock is there to protect the normal UDP receive path. Encapsulation UDP sockets don't need that protection. In fact the locking is deadly for them as they may contain another UDP packet within, possibly with the same addresses. Also the nested bit was copied from TCP. TCP needs it because of accept(2) spawning sockets. This simply doesn't apply to UDP so I've removed it. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

pkt_sched: Fix actions referencing

2008-09-08T11:44:24Z

[ Upstream commit 76aab2c1eae491a5d73ac83deec97dd28ebac584 ] When an action is added several times with the same exact index it gets deleted on every even-numbered attempt. This fixes that issue. Signed-off-by: Jamal Hadi Salim Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman

pkt_sched: Fix return value corruption in HTB and TBF.

2008-09-08T11:44:23Z

[ Upstream commit 69747650c814a8a79fef412c7416adf823293a3e ] Based upon a bug report by Josip Rodin. Packet schedulers should only return NET_XMIT_DROP iff the packet really was dropped. If the packet does reach the device after we return NET_XMIT_DROP then TCP can crash because it depends upon the enqueue path return values being accurate. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman