Commit 20aa9e33 authored by Dann Frazier's avatar Dann Frazier

* bugfix/nl_fib_lookup-oops.patch

  Add fix for oops bug added by previous patch

svn path=/dists/etch-security/linux-2.6/; revision=8534
parent 6ca43dd4
...@@ -11,8 +11,10 @@ linux-2.6 (2.6.18.dfsg.1-12etch2) UNRELEASED; urgency=high ...@@ -11,8 +11,10 @@ linux-2.6 (2.6.18.dfsg.1-12etch2) UNRELEASED; urgency=high
* bugfix/netlink-infinite-recursion.patch * bugfix/netlink-infinite-recursion.patch
[SECURITY] Fix infinite recursion bug in netlink [SECURITY] Fix infinite recursion bug in netlink
See CVE-2007-1861 See CVE-2007-1861
* bugfix/nl_fib_lookup-oops.patch
Add fix for oops bug added by previous patch
-- dann frazier <dannf@debian.org> Mon, 30 Apr 2007 19:45:38 -0600 -- dann frazier <dannf@debian.org> Tue, 01 May 2007 08:34:18 -0600
linux-2.6 (2.6.18.dfsg.1-12etch1) stable-security; urgency=high linux-2.6 (2.6.18.dfsg.1-12etch1) stable-security; urgency=high
......
From: Sergey Vlasov <vsu@altlinux.ru>
Date: Fri, 27 Apr 2007 09:18:35 +0000 (-0700)
Subject: IPV4: Fix OOPS'er added to netlink fib.
X-Git-Tag: v2.6.20.10~2
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fstable%2Flinux-2.6.20.y.git;a=commitdiff_plain;h=6af3412cff50b9a7b12b7b9cf6f01b34fbae4624
IPV4: Fix OOPS'er added to netlink fib.
[IPV4] nl_fib_lookup: Initialise res.r before fib_res_put(&res)
When CONFIG_IP_MULTIPLE_TABLES is enabled, the code in nl_fib_lookup()
needs to initialize the res.r field before fib_res_put(&res) - unlike
fib_lookup(), a direct call to ->tb_lookup does not set this field.
Signed-off-by: Sergey Vlasov <vsu@altlinux.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index fa2cb8c..30aae76 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -773,6 +773,10 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb )
.tos = frn->fl_tos,
.scope = frn->fl_scope } } };
+#ifdef CONFIG_IP_MULTIPLE_TABLES
+ res.r = NULL;
+#endif
+
frn->err = -ENOENT;
if (tb) {
local_bh_disable();
+ bugfix/nfnetlink_log-null-deref.patch + bugfix/nfnetlink_log-null-deref.patch
+ bugfix/nf_conntrack-set-nfctinfo.patch + bugfix/nf_conntrack-set-nfctinfo.patch
+ bugfix/netlink-infinite-recursion.patch + bugfix/netlink-infinite-recursion.patch
+ bugfix/nl_fib_lookup-oops.patch
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment