Linux 2.6.18.7

Linux 2.6.18.7

[Greg KH]

We (the -stable team) are announcing the release of the 2.6.18.7 kernel.
It contains one NFS fix that if you run a NFS server, you might want to
apply.

The diffstat and short summary of the fixes are below.

I'll also be replying to this message with a copy of the patch between
2.6.18.6 and 2.6.18.7, as it is small enough to do so.

The updated 2.6.18.y git tree can be found at:
        git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.18.y.git
and can be browsed at the normal kernel.org git web browser:
        www.kernel.org/git/

thanks,

greg k-h
--------

 Makefile          |    2 +-
 fs/nfsd/nfs2acl.c |   17 ++++++++++++-----
 2 files changed, 13 insertions(+), 6 deletions(-)

Summary of changes from v2.6.18.6 to v2.6.18.7
==============================================

Greg Banks (1):
      Fix a free-wrong-pointer bug in nfs/acl server (CVE-2007-0772)

Greg Kroah-Hartman (1):
      Linux 2.6.18.7

Re: Linux 2.6.18.7

[Greg KH]

diff --git a/Makefile b/Makefile
index c8b2f7e..ed22616 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 18
-EXTRAVERSION = .6
+EXTRAVERSION = .7
 NAME=Avast! A bilge rat!
 
 # *DOCUMENTATION*
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index fc95c4d..c318b6f 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -287,13 +287,20 @@ static int nfsaclsvc_release_getacl(struct svc_rqst *rqstp, u32 *p,
 	return 1;
 }
 
-static int nfsaclsvc_release_fhandle(struct svc_rqst *rqstp, u32 *p,
-		struct nfsd_fhandle *resp)
+static int nfsaclsvc_release_attrstat(struct svc_rqst *rqstp, u32 *p,
+		struct nfsd_attrstat *resp)
 {
 	fh_put(&resp->fh);
 	return 1;
 }
 
+static int nfsaclsvc_release_access(struct svc_rqst *rqstp, u32 *p,
+               struct nfsd3_accessres *resp)
+{
+       fh_put(&resp->fh);
+       return 1;
+}
+
 #define nfsaclsvc_decode_voidargs	NULL
 #define nfsaclsvc_encode_voidres	NULL
 #define nfsaclsvc_release_void		NULL
@@ -322,9 +329,9 @@ struct nfsd3_voidargs { int dummy; };
 static struct svc_procedure		nfsd_acl_procedures2[] = {
   PROC(null,	void,		void,		void,	  RC_NOCACHE, ST),
   PROC(getacl,	getacl,		getacl,		getacl,	  RC_NOCACHE, ST+1+2*(1+ACL)),
-  PROC(setacl,	setacl,		attrstat,	fhandle,  RC_NOCACHE, ST+AT),
-  PROC(getattr, fhandle,	attrstat,	fhandle,  RC_NOCACHE, ST+AT),
-  PROC(access,	access,		access,		fhandle,  RC_NOCACHE, ST+AT+1),
+  PROC(setacl,	setacl,		attrstat,	attrstat, RC_NOCACHE, ST+AT),
+  PROC(getattr, fhandle,	attrstat,	attrstat, RC_NOCACHE, ST+AT),
+  PROC(access,	access,		access,		access,   RC_NOCACHE, ST+AT+1),
 };
 
 struct svc_version	nfsd_acl_version2 = {

Re: Linux 2.6.18.7

[Chuck Ebbert]

Greg KH wrote:
> We (the -stable team) are announcing the release of the 2.6.18.7 kernel.
> It contains one NFS fix that if you run a NFS server, you might want to
> apply.

Well that's nice.  There's at least one other unfixed CVE
in 2.6.18.6 -- why didn't you fix that?  (The patch has been
queued for two months now.)

Re: Linux 2.6.18.7

[Greg KH]

On Tue, Feb 20, 2007 at 04:30:55PM -0500, Chuck Ebbert wrote:
> Greg KH wrote:
> > We (the -stable team) are announcing the release of the 2.6.18.7 kernel.
> > It contains one NFS fix that if you run a NFS server, you might want to
> > apply.
> 
> Well that's nice.  There's at least one other unfixed CVE
> in 2.6.18.6 -- why didn't you fix that?  (The patch has been
> queued for two months now.)

I'm working on pushing the 2.6.18-stable queue out soon, sorry, been
backed up with other things recently.

I pushed this one out so quickly, as it was able to be triggered
remotely, unlike the current patches in the 2.6.18-stable queue.

thanks,

greg k-h