rpms/kernel/F-10 make-sock_sendpage-use-kernel_sendpage.patch, 1.1, 1.2 posix-timers-fix-oops-in-clock_nanosleep.patch, NONE, 1.1 kernel.spec, 1.1396, 1.1397

Sat Aug 15 04:32:10 UTC 2009

Author: kyle

Update of /cvs/pkgs/rpms/kernel/F-10
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv16077

Modified Files:
	kernel.spec 
Added Files:
	make-sock_sendpage-use-kernel_sendpage.patch 
	posix-timers-fix-oops-in-clock_nanosleep.patch 
Log Message:
* Sat Aug 15 2009 Kyle McMartin <kyle at redhat.com> 2.6.29.6-96
- For F-10-updates-testing:
- CVE-2009-2767: Fix clock_nanosleep NULL ptr deref.
- CVE-2009-2692: Fix sock sendpage NULL ptr deref.


make-sock_sendpage-use-kernel_sendpage.patch:
 socket.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: make-sock_sendpage-use-kernel_sendpage.patch
===================================================================
RCS file: make-sock_sendpage-use-kernel_sendpage.patch
diff -N make-sock_sendpage-use-kernel_sendpage.patch
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ make-sock_sendpage-use-kernel_sendpage.patch	15 Aug 2009 04:32:10 -0000	1.2
@@ -0,0 +1,37 @@
+From: Linus Torvalds <torvalds at linux-foundation.org>
+Date: Thu, 13 Aug 2009 15:28:36 +0000 (-0700)
+Subject: Make sock_sendpage() use kernel_sendpage()
+X-Git-Tag: v2.6.31-rc6~8
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=e694958388c50148389b0e9b9e9e8945cf0f1b98
+
+Make sock_sendpage() use kernel_sendpage()
+
+kernel_sendpage() does the proper default case handling for when the
+socket doesn't have a native sendpage implementation.
+
+Now, arguably this might be something that we could instead solve by
+just specifying that all protocols should do it themselves at the
+protocol level, but we really only care about the common protocols.
+Does anybody really care about sendpage on something like Appletalk? Not
+likely.
+
+Acked-by: David S. Miller <davem at davemloft.net>
+Acked-by: Julien TINNES <julien at cr0.org>
+Acked-by: Tavis Ormandy <taviso at sdf.lonestar.org>
+Cc: stable at kernel.org
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+---
+
+diff --git a/net/socket.c b/net/socket.c
+index 791d71a..6d47165 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -736,7 +736,7 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
+ 	if (more)
+ 		flags |= MSG_MORE;
+ 
+-	return sock->ops->sendpage(sock, page, offset, size, flags);
++	return kernel_sendpage(sock, page, offset, size, flags);
+ }
+ 
+ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,

posix-timers-fix-oops-in-clock_nanosleep.patch:
 posix-timers.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- NEW FILE posix-timers-fix-oops-in-clock_nanosleep.patch ---
From: Hiroshi Shimamoto <h-shimamoto at ct.jp.nec.com>
Date: Mon, 3 Aug 2009 02:48:19 +0000 (+0900)
Subject: posix-timers: Fix oops in clock_nanosleep() with CLOCK_MONOTONIC_RAW
X-Git-Tag: v2.6.31-rc6~76^2
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=70d715fd0597f18528f389b5ac59102263067744

posix-timers: Fix oops in clock_nanosleep() with CLOCK_MONOTONIC_RAW

Prevent calling do_nanosleep() with clockid
CLOCK_MONOTONIC_RAW, it may cause oops, such as NULL pointer
dereference.

Signed-off-by: Hiroshi Shimamoto <h-shimamoto at ct.jp.nec.com>
Cc: Andrew Morton <akpm at linux-foundation.org>
Cc: Thomas Gleixner <tglx at linutronix.de>
Cc: John Stultz <johnstul at us.ibm.com>
Cc: <stable at kernel.org>
LKML-Reference: <4A764FF3.50607 at ct.jp.nec.com>
Signed-off-by: Ingo Molnar <mingo at elte.hu>
---

diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 052ec4d..d089d05 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -202,6 +202,12 @@ static int no_timer_create(struct k_itimer *new_timer)
 	return -EOPNOTSUPP;
 }
 
+static int no_nsleep(const clockid_t which_clock, int flags,
+		     struct timespec *tsave, struct timespec __user *rmtp)
+{
+	return -EOPNOTSUPP;
+}
+
 /*
  * Return nonzero if we know a priori this clockid_t value is bogus.
  */
@@ -254,6 +260,7 @@ static __init int init_posix_timers(void)
 		.clock_get = posix_get_monotonic_raw,
 		.clock_set = do_posix_clock_nosettime,
 		.timer_create = no_timer_create,
+		.nsleep = no_nsleep,
 	};
 
 	register_posix_clock(CLOCK_REALTIME, &clock_realtime);


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-10/kernel.spec,v
retrieving revision 1.1396
retrieving revision 1.1397
diff -u -p -r1.1396 -r1.1397
--- kernel.spec	28 Jul 2009 20:04:17 -0000	1.1396
+++ kernel.spec	15 Aug 2009 04:32:10 -0000	1.1397
@@ -598,6 +598,9 @@ Patch30: linux-2.6-iommu-fixes.patch
 
 Patch41: linux-2.6-sysrq-c.patch
 
+Patch50: make-sock_sendpage-use-kernel_sendpage.patch
+Patch51: posix-timers-fix-oops-in-clock_nanosleep.patch
+
 Patch81: linux-2.6-defaults-saner-vm-settings.patch
 Patch90: linux-2.6-mm-lru-evict-streaming-io-pages-first.patch
 Patch91: linux-2.6-mm-lru-report-vm-flags-in-page-referenced.patch
@@ -1167,6 +1170,9 @@ ApplyPatch linux-2.6-iommu-fixes.patch
 # enable sysrq-c on all kernels, not only kexec
 ApplyPatch linux-2.6-sysrq-c.patch
 
+ApplyPatch make-sock_sendpage-use-kernel_sendpage.patch
+ApplyPatch posix-timers-fix-oops-in-clock_nanosleep.patch
+
 ApplyPatch linux-2.6-defaults-saner-vm-settings.patch
 ApplyPatch linux-2.6-mm-lru-evict-streaming-io-pages-first.patch
 ApplyPatch linux-2.6-mm-lru-report-vm-flags-in-page-referenced.patch
@@ -1987,6 +1993,11 @@ fi
 %kernel_variant_files -k vmlinux %{with_kdump} kdump
 
 %changelog
+* Sat Aug 15 2009 Kyle McMartin <kyle at redhat.com> 2.6.29.6-96
+- For F-10-updates-testing:
+- CVE-2009-2767: Fix clock_nanosleep NULL ptr deref.
+- CVE-2009-2692: Fix sock sendpage NULL ptr deref.
+
 * Tue Jul 28 2009 Eric Sandeen <sandeen at redhat.com>
 - Fix eCryptfs overflow issues (CVE-2009-2406, CVE-2009-2407)
 


