Linux 2.6.16.58

Linux 2.6.16.58

[Adrian Bunk]

Security fixes since 2.6.16.57:
- CVE-2007-2525: PPPOE: fix memory leak (local DoS)
- CVE-2007-3731: Handle bogus %cs selector in single-step instruction decoding
- CVE-2007-6417: tmpfs: restore missing clear_highpage


Location:
ftp://ftp.kernel.org/pub/linux/kernel/v2.6/

git tree:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.16.y.git

RSS feed of the git tree:
http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=rss


Changes since 2.6.16.57:

Adrian Bunk (3):
      ipv4/arp.c:arp_process(): remove bogus #ifdef mess
      Linux 2.6.16.58-rc1
      Linux 2.6.16.58

Alan Cox (1):
      [SCSI] aacraid: fix security weakness

Ben Collins (1):
      [ATM]: Add CPPFLAGS to byteorder.h check

Charles Hardin (1):
      [PFKEY]: Sending an SADB_GET responds with an SADB_GET

Chas Williams (1):
      [ATM]: [he] initialize lock and tasklet earlier

Evgeniy Polyakov (1):
      [PKT_SCHED]: Fix OOPS when removing devices from a teql queuing discipline

Florian Zumbiehl (1):
      PPPOE: fix memory leak (local DoS) (CVE-2007-2525)

Hugh Dickins (1):
      tmpfs: restore missing clear_highpage (CVE-2007-6417)

Jean Delvare (2):
      hwmon/lm87: Disable VID when it should be
      hwmon/lm87: Fix a division by zero

Michal Schmidt (1):
      [PPP_MPPE]: Don't put InterimKey on the stack

Patrick McHardy (2):
      [INET_DIAG]: Fix oops in netlink_rcv_skb
      [NETLINK]: Fix unicast timeouts

Peter Zijlstra (1):
      i386: fixup TRACE_IRQ breakage

Radu Rendec (1):
      [PKT_SCHED] CLS_U32: Fix endianness problem with u32 classifier hash masks.

Roland McGrath (1):
      Handle bogus %cs selector in single-step instruction decoding (CVE-2007-3731)

YOSHIFUJI Hideaki (1):
      [IPV6]: Fix unbalanced socket reference with MSG_CONFIRM.


 Makefile                     |    2 +-
 arch/i386/kernel/entry.S     |    1 -
 arch/i386/kernel/ptrace.c    |   22 +++++++++++++++-------
 arch/i386/kernel/traps.c     |   10 ++++++----
 arch/x86_64/kernel/ptrace.c  |   23 ++++++++++++++++-------
 drivers/atm/Makefile         |    2 +-
 drivers/atm/he.c             |   10 +++++-----
 drivers/hwmon/lm87.c         |    4 ++--
 drivers/net/ppp_mppe.c       |   14 ++++++--------
 drivers/net/pppox.c          |    2 +-
 drivers/scsi/aacraid/linit.c |    4 ++--
 include/linux/netlink.h      |    2 +-
 ipc/mqueue.c                 |    6 ++++--
 mm/shmem.c                   |    5 +++--
 net/ipv4/arp.c               |   19 -------------------
 net/ipv4/inet_diag.c         |   10 +++++++++-
 net/ipv6/raw.c               |    2 +-
 net/key/af_key.c             |    2 +-
 net/netlink/af_netlink.c     |   10 +++++-----
 net/sched/cls_u32.c          |    4 ++--
 net/sched/sch_teql.c         |    3 +++
 21 files changed, 84 insertions(+), 73 deletions(-)

Re: Linux 2.6.16.58

[Jiri Kosina]

On Wed, 16 Jan 2008, Adrian Bunk wrote:

> RSS feed of the git tree:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=rss
> Changes since 2.6.16.57:
> Adrian Bunk (3):
>       ipv4/arp.c:arp_process(): remove bogus #ifdef mess
>       Linux 2.6.16.58-rc1
>       Linux 2.6.16.58

Hi Adrian,

I don't seem to see v2.6.16.58 tag in your git repository -- the HEAD 
(a8d648b74) is tagged v2.6.16.58-rc1. Is that intended?

-- 
Jiri Kosina

Re: Linux 2.6.16.58

[Willy Tarreau]

Hi,

On Wed, Jan 16, 2008 at 05:04:17PM +0100, Jiri Kosina wrote:
> On Wed, 16 Jan 2008, Adrian Bunk wrote:
> 
> > RSS feed of the git tree:
> > http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=rss
> > Changes since 2.6.16.57:
> > Adrian Bunk (3):
> >       ipv4/arp.c:arp_process(): remove bogus #ifdef mess
> >       Linux 2.6.16.58-rc1
> >       Linux 2.6.16.58
> 
> Hi Adrian,
> 
> I don't seem to see v2.6.16.58 tag in your git repository -- the HEAD 
> (a8d648b74) is tagged v2.6.16.58-rc1. Is that intended?

Not replying for Adrian, but it happened several times to me too.
What sometimes happens when we push Git updates from home is that
we don't push all the refs. Sometimes I forget to update the tags,
sometimes the master, etc...

Just looked at the git repo itself, it looks like it has not changed
since 2008/01/08 :-/

Adrian, maybe your git-push did not succeed ?

Regards,
Willy

Re: Linux 2.6.16.58

[Adrian Bunk]

On Wed, Jan 16, 2008 at 05:04:17PM +0100, Jiri Kosina wrote:
> On Wed, 16 Jan 2008, Adrian Bunk wrote:
> 
> > RSS feed of the git tree:
> > http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=rss
> > Changes since 2.6.16.57:
> > Adrian Bunk (3):
> >       ipv4/arp.c:arp_process(): remove bogus #ifdef mess
> >       Linux 2.6.16.58-rc1
> >       Linux 2.6.16.58
> 
> Hi Adrian,

Hi Jiri,

> I don't seem to see v2.6.16.58 tag in your git repository -- the HEAD 
> (a8d648b74) is tagged v2.6.16.58-rc1. Is that intended?

do you insist on hearing the truth ("Sorry, I forgot to push."), or can 
I tell you "I just wanted to see whether anyone notices." instead?  ;-)

> Jiri Kosina

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: Linux 2.6.16.58

[Willy Tarreau]

Hi Adrian,

On Thu, Jan 17, 2008 at 10:34:16PM +0200, Adrian Bunk wrote:
> do you insist on hearing the truth ("Sorry, I forgot to push."), or can 
> I tell you "I just wanted to see whether anyone notices." instead?  ;-)

:-)

I think we should intentionally do this test once in a while. Two days
ago I was informed that 2.6.20.21 (the latest 2.6.20 I pushed 3 months
ago) was not clonable nor pullable due to a problem with the HEAD
pointing to latest tag instead of latest commit. Since the error was
also present in my local tree, I'm certain that it remained there
unnoticed for 3 months !

Cheers,
Willy

Re: Linux 2.6.16.58

[Adrian Bunk]

On Thu, Jan 17, 2008 at 10:12:05PM +0100, Willy Tarreau wrote:
> Hi Adrian,
> 
> On Thu, Jan 17, 2008 at 10:34:16PM +0200, Adrian Bunk wrote:
> > do you insist on hearing the truth ("Sorry, I forgot to push."), or can 
> > I tell you "I just wanted to see whether anyone notices." instead?  ;-)
> 
> :-)
> 
> I think we should intentionally do this test once in a while. Two days
> ago I was informed that 2.6.20.21 (the latest 2.6.20 I pushed 3 months
> ago) was not clonable nor pullable due to a problem with the HEAD
> pointing to latest tag instead of latest commit. Since the error was
> also present in my local tree, I'm certain that it remained there
> unnoticed for 3 months !

According to git [1] Ralf merged 2.6.20.21 on 2007-10-18 into the 2.6.20 
branch of his mips tree, so it must have been somehow possible...

> Cheers,
> Willy

cu
Adrian

[1] http://www.linux-mips.org/git?p=linux.git;a=shortlog;h=linux-2.6.20-stable

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: Linux 2.6.16.58

[Willy Tarreau]

On Thu, Jan 17, 2008 at 11:47:55PM +0200, Adrian Bunk wrote:
> On Thu, Jan 17, 2008 at 10:12:05PM +0100, Willy Tarreau wrote:
> > Hi Adrian,
> > 
> > On Thu, Jan 17, 2008 at 10:34:16PM +0200, Adrian Bunk wrote:
> > > do you insist on hearing the truth ("Sorry, I forgot to push."), or can 
> > > I tell you "I just wanted to see whether anyone notices." instead?  ;-)
> > 
> > :-)
> > 
> > I think we should intentionally do this test once in a while. Two days
> > ago I was informed that 2.6.20.21 (the latest 2.6.20 I pushed 3 months
> > ago) was not clonable nor pullable due to a problem with the HEAD
> > pointing to latest tag instead of latest commit. Since the error was
> > also present in my local tree, I'm certain that it remained there
> > unnoticed for 3 months !
> 
> According to git [1] Ralf merged 2.6.20.21 on 2007-10-18 into the 2.6.20 
> branch of his mips tree, so it must have been somehow possible...

Maybe he did this locally (Linus showed me that local FS cloning disables
a lot of tests). Or maybe it could work for some pulls :-/ Definitely a
weird issue anyway!

Cheers,
Willy

Re: Linux 2.6.16.58

[Henrique de Moraes Holschuh]

On Thu, 17 Jan 2008, Willy Tarreau wrote:
> On Thu, Jan 17, 2008 at 11:47:55PM +0200, Adrian Bunk wrote:
> > On Thu, Jan 17, 2008 at 10:12:05PM +0100, Willy Tarreau wrote:
> > > On Thu, Jan 17, 2008 at 10:34:16PM +0200, Adrian Bunk wrote:
> > > > do you insist on hearing the truth ("Sorry, I forgot to push."), or can 
> > > > I tell you "I just wanted to see whether anyone notices." instead?  ;-)
> > > 
> > > :-)
> > > 
> > > I think we should intentionally do this test once in a while. Two days
> > > ago I was informed that 2.6.20.21 (the latest 2.6.20 I pushed 3 months
> > > ago) was not clonable nor pullable due to a problem with the HEAD
> > > pointing to latest tag instead of latest commit. Since the error was
> > > also present in my local tree, I'm certain that it remained there
> > > unnoticed for 3 months !
> > 
> > According to git [1] Ralf merged 2.6.20.21 on 2007-10-18 into the 2.6.20 
> > branch of his mips tree, so it must have been somehow possible...
> 
> Maybe he did this locally (Linus showed me that local FS cloning disables
> a lot of tests). Or maybe it could work for some pulls :-/ Definitely a
> weird issue anyway!

Err... I managed to do it for thinkpad-acpi's merge tree too, a lot of time
ago.  So it was somehow possible to get it through the anonymous git server,
probably through the tag.  What I do know is that I usually send head's up
email when I notice something like this, and I find it strange that you
didn't get one from me at that time... but I may have forgotten to send it
at that time.

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh

Re: Linux 2.6.16.58

[Willy Tarreau]

On Thu, Jan 17, 2008 at 08:02:19PM -0200, Henrique de Moraes Holschuh wrote:
> Err... I managed to do it for thinkpad-acpi's merge tree too, a lot of time
> ago.  So it was somehow possible to get it through the anonymous git server,
> probably through the tag.  What I do know is that I usually send head's up
> email when I notice something like this, and I find it strange that you
> didn't get one from me at that time... but I may have forgotten to send it
> at that time.

Well, since there are commands that work on this (push and log at
least), I believe that some operations could succeed. I *know* that
remote cloning was impossible, and it *looked* like pulling too was
during my attempts to fix the problem before understanding its root
cause. It is possible that I cumulated problems though, if at least
two people could pull from it.

Cheers,
Willy

Re: Linux 2.6.16.58

[Henrique de Moraes Holschuh]

On Thu, 17 Jan 2008, Willy Tarreau wrote:
> Well, since there are commands that work on this (push and log at
> least), I believe that some operations could succeed. I *know* that
> remote cloning was impossible, and it *looked* like pulling too was
> during my attempts to fix the problem before understanding its root
> cause. It is possible that I cumulated problems though, if at least
> two people could pull from it.

Ah, I think I recalled something about the episode.  I knew the tag was
there (gitweb), and I did have some trouble to get it, but I *think* what
worked out was:

git fetch <repo> <tag>

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh