Linux 2.6.16.7

Linux 2.6.16.7

[Greg KH]

We (the -stable team) are announcing the release of the 2.6.16.7 kernel.

The diffstat and short summary of the fixes are below.

I'll also be replying to this message with a copy of the patch between
2.6.16.6 and 2.6.16.7, as it is small enough to do so.

The updated 2.6.16.y git tree can be found at:
 	rsync://rsync.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.16.y.git
and can be browsed at the normal kernel.org git web browser:
	www.kernel.org/git/

Note, there seems to be a bit of a discrepancy in the assigning of CVE
numbers to a specific issue that was solved in this release.  The
original author and I both asked for CVE numbers for different patches
and seem to have gotten the same one.  Please note that these are two
different issues, yet, the same CVE number.  Hopefully it gets fixed
eventually for those who like to track these kinds of things...

thanks,

greg k-h

--------

 Makefile     |    2 +-
 mm/madvise.c |    3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)


Summary of changes from v2.6.16.6 to v2.6.16.7
==============================================

Greg Kroah-Hartman:
      Linux 2.6.16.7

Hugh Dickins:
      fix MADV_REMOVE vulnerability (CVE-2006-1524 for real this time)

Re: Linux 2.6.16.7

[Greg KH]

diff --git a/Makefile b/Makefile
index 7959505..06a8926 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 16
-EXTRAVERSION = .6
+EXTRAVERSION = .7
 NAME=Sliding Snow Leopard
 
 # *DOCUMENTATION*
diff --git a/mm/madvise.c b/mm/madvise.c
index af3d573..4e19615 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -168,6 +168,9 @@ static long madvise_remove(struct vm_are
 			return -EINVAL;
 	}
 
+	if ((vma->vm_flags & (VM_SHARED|VM_WRITE)) != (VM_SHARED|VM_WRITE))
+		return -EACCES;
+
 	mapping = vma->vm_file->f_mapping;
 
 	offset = (loff_t)(start - vma->vm_start)

Re: Linux 2.6.16.7

[Alexander E. Patrakov]

Greg KH wrote:
> -EXTRAVERSION = .6
> +EXTRAVERSION = .7

Hello, I would like to know if there is a plan to include this in the next 
-stable update?

http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blobdiff;h=2731570eba5b35a21c311dd587057c39805082f1;hp=dfb62998866ae2e298139164a85ec0757b7f3fc7;hb=9469d458b90bfb9117cbb488cfa645d94c3921b1;f=net/core/dev.c

-- 
Alexander E. Patrakov

Re: Linux 2.6.16.7

[Greg KH]

On Tue, Apr 18, 2006 at 12:58:07PM +0600, Alexander E. Patrakov wrote:
> Greg KH wrote:
> >-EXTRAVERSION = .6
> >+EXTRAVERSION = .7
> 
> Hello, I would like to know if there is a plan to include this in the next 
> -stable update?
> 
> http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blobdiff;h=2731570eba5b35a21c311dd587057c39805082f1;hp=dfb62998866ae2e298139164a85ec0757b7f3fc7;hb=9469d458b90bfb9117cbb488cfa645d94c3921b1;f=net/core/dev.c

No one has submitted it to the stable@kernel.org mail address from what
I can see, so no, it is not in the queue.  If you think otherwise,
please send it.

thanks,

greg k-h

Re: Linux 2.6.16.7

[Nick Warne]

> No one has submitted it to the stable@kernel.org mail address from what
> I can see, so no, it is not in the queue.  If you think otherwise,
> please send it.
>
> thanks,
>
> greg k-h

I thought the 2.6.xx.n series was the 'stable' (as per kernel.org)?

Nick

Re: Linux 2.6.16.7

[Greg KH]

On Tue, Apr 18, 2006 at 07:52:19PM +0100, Nick Warne wrote:
> > No one has submitted it to the stable@kernel.org mail address from what
> > I can see, so no, it is not in the queue.  If you think otherwise,
> > please send it.
> >
> > thanks,
> >
> > greg k-h
> 
> I thought the 2.6.xx.n series was the 'stable' (as per kernel.org)?

Yes it is.  Did I say otherwise in those sentences?

thanks,

greg k-h

Re: Linux 2.6.16.7

[Nick Warne]

On Tuesday 18 April 2006 20:06, Greg KH wrote:
> On Tue, Apr 18, 2006 at 07:52:19PM +0100, Nick Warne wrote:
> > > No one has submitted it to the stable@kernel.org mail address from what
> > > I can see, so no, it is not in the queue.  If you think otherwise,
> > > please send it.
> > >
> > > thanks,
> > >
> > > greg k-h
> >
> > I thought the 2.6.xx.n series was the 'stable' (as per kernel.org)?
>
> Yes it is.  Did I say otherwise in those sentences?

Argh, I see... Alexander said:

> Greg KH wrote:
>>  -EXTRAVERSION = .6
>> +EXTRAVERSION = .7

> Hello, I would like to know if there is a plan to include this in the next
> -stable update?

I misread the ref. to the different link/patch referred too...

Sorry for the noise.

Nick


-- 
"Person who say it cannot be done should not interrupt person doing it."
-Chinese Proverb

Re: Linux 2.6.16.7

[Alexander E. Patrakov]

Greg KH wrote:
> On Tue, Apr 18, 2006 at 12:58:07PM +0600, Alexander E. Patrakov wrote:
>   
>> Greg KH wrote:
>>     
>>> -EXTRAVERSION = .6
>>> +EXTRAVERSION = .7
>>>       
>> Hello, I would like to know if there is a plan to include this in the next 
>> -stable update?
>>
>> http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blobdiff;h=2731570eba5b35a21c311dd587057c39805082f1;hp=dfb62998866ae2e298139164a85ec0757b7f3fc7;hb=9469d458b90bfb9117cbb488cfa645d94c3921b1;f=net/core/dev.c
>>     
>
> No one has submitted it to the stable@kernel.org mail address from what
> I can see, so no, it is not in the queue.  If you think otherwise,
> please send it.
>   
Without that patch, there is a race when registering network interfaces 
and renaming it with udev rules, because initially the "address" in 
sysfs doesn't contain useful data. See 
http://marc.theaimsgroup.com/?t=114460338900002&r=1&w=2

Breaking the recommended way of assigning persistent network interface 
names is, IMHO, a bug serious enough to be fixed in -stable.

Signed-off-by: Alexander E. Patrakov <patrakov@ums.usu.ru>

---

--- linux-2.6.16.5/net/core/dev.c
+++ linux-2.6.16.5/net/core/dev.c
@@ -2932,11 +2932,11 @@
 
 		switch(dev->reg_state) {
 		case NETREG_REGISTERING:
+			dev->reg_state = NETREG_REGISTERED;
 			err = netdev_register_sysfs(dev);
 			if (err)
 				printk(KERN_ERR "%s: failed sysfs registration (%d)\n",
 				       dev->name, err);
-			dev->reg_state = NETREG_REGISTERED;
 			break;
 
 		case NETREG_UNREGISTERING:

-- 
Alexander E. Patrakov

Re: Linux 2.6.16.7

[David S. Miller]

From: "Alexander E. Patrakov" <patrakov@ums.usu.ru>
Date: Wed, 19 Apr 2006 10:22:39 +0600

> Without that patch, there is a race when registering network interfaces 
> and renaming it with udev rules, because initially the "address" in 
> sysfs doesn't contain useful data. See 
> http://marc.theaimsgroup.com/?t=114460338900002&r=1&w=2
> 
> Breaking the recommended way of assigning persistent network interface 
> names is, IMHO, a bug serious enough to be fixed in -stable.
> 
> Signed-off-by: Alexander E. Patrakov <patrakov@ums.usu.ru>

I've been waiting to see if there is any negative fallout
from this change, but I guess it's OK for stable.

Re: [stable] Re: Linux 2.6.16.7

[Greg KH]

On Tue, Apr 18, 2006 at 09:41:21PM -0700, David S. Miller wrote:
> From: "Alexander E. Patrakov" <patrakov@ums.usu.ru>
> Date: Wed, 19 Apr 2006 10:22:39 +0600
> 
> > Without that patch, there is a race when registering network interfaces 
> > and renaming it with udev rules, because initially the "address" in 
> > sysfs doesn't contain useful data. See 
> > http://marc.theaimsgroup.com/?t=114460338900002&r=1&w=2
> > 
> > Breaking the recommended way of assigning persistent network interface 
> > names is, IMHO, a bug serious enough to be fixed in -stable.
> > 
> > Signed-off-by: Alexander E. Patrakov <patrakov@ums.usu.ru>
> 
> I've been waiting to see if there is any negative fallout
> from this change, but I guess it's OK for stable.

Thanks for the ack.

Queued to -stable, thanks.

greg k-h

Hotplug race on name change

[Stephen Hemminger]

This:
> Without that patch, there is a race when registering network interfaces 
> and renaming it with udev rules, because initially the "address" in 
> sysfs doesn't contain useful data. See 
> http://marc.theaimsgroup.com/?t=114460338900002&r=1&w=2
> 
> Breaking the recommended way of assigning persistent network interface 
> names is, IMHO, a bug serious enough to be fixed in -stable.
> 
> Signed-off-by: Alexander E. Patrakov <patrakov@ums.usu.ru>
> 
> ---
> 
> --- linux-2.6.16.5/net/core/dev.c
> +++ linux-2.6.16.5/net/core/dev.c
> @@ -2932,11 +2932,11 @@
>  
>  		switch(dev->reg_state) {
>  		case NETREG_REGISTERING:
> +			dev->reg_state = NETREG_REGISTERED;
>  			err = netdev_register_sysfs(dev);
>  			if (err)
>  				printk(KERN_ERR "%s: failed sysfs registration (%d)\n",
>  				       dev->name, err);
> -			dev->reg_state = NETREG_REGISTERED;
>  			break;
>  
>  		case NETREG_UNREGISTERING:

Introduces new races in netdev_register_sysfs if the name changes, because
netdev_register_sysfs runs without RTNL at this point. So if some application gets
in and changes the device name while netdev_register_sysfs is running, then
the class_dev->class_id would end up not matching the netdevice->name.

Not a big issue since, hotplug doesn't get run until the device is registered.
Ideally, it would be possible to create the groups in the class device before it
was registered. It won't work with existing class device interface.

I am working on a patch to extend class_device to allow the creation of groups
to be atomic (like the attributes are).