Linux 2.6.17.1

Linux 2.6.17.1

[Chris Wright]

We (the -stable team) are announcing the release of the 2.6.17.1 kernel.

The diffstat and short summary of the fixes are below.

I'll also be replying to this message with a copy of the patch between
2.6.17 and 2.6.17.1, as it is small enough to do so.

The updated 2.6.17.y git tree can be found at:
 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.17.y.git
and can be browsed at the normal kernel.org git web browser:
	www.kernel.org/git/
(note: the main -stable git tree update will lag a half-day or so for this one,
use git://git.kernel.org/pub/scm/linux/kernel/git/chrisw/linux-2.6.17.y.git for
now)

thanks,
-chris

--------

 Makefile                |    2 +-
 net/netfilter/xt_sctp.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Summary of changes from v2.6.17 to v2.6.17.1
================================================

Chris Wright:
      Linux 2.6.17.1

Patrick McHardy:
      xt_sctp: fix endless loop caused by 0 chunk length (CVE-2006-3085)

Re: Linux 2.6.17.1

[Chris Wright]

diff --git a/Makefile b/Makefile
index 1700d3f..8bafed1 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 17
-EXTRAVERSION =
+EXTRAVERSION = .1
 NAME=Crazed Snow-Weasel
 
 # *DOCUMENTATION*
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
index 34bd872..c29692c 100644
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -62,7 +62,7 @@ #endif
 
 	do {
 		sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch);
-		if (sch == NULL) {
+		if (sch == NULL || sch->length == 0) {
 			duprintf("Dropping invalid SCTP packet.\n");
 			*hotdrop = 1;
 			return 0;

Re: Linux 2.6.17.1

[Michael Buesch]

On Tuesday 20 June 2006 12:13, Chris Wright wrote:
> We (the -stable team) are announcing the release of the 2.6.17.1 kernel.

Please consider inclusion of the following patch into 2.6.17.2:

It fixes a possible crash. Might be triggerable in networks with
heavy traffic. I only saw it once so far, though.

--

Place the Init-vs-IRQ workaround before any card register
access, because we might not have the wireless core mapped
at all times in init. So this will result in a Machine Check
caused by a bus error.

Signed-off-by: Michael Buesch <mb@bu3sch.de>

Index: tmp/drivers/net/wireless/bcm43xx/bcm43xx_main.c
===================================================================
--- tmp.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c	2006-06-18 18:51:48.000000000 +0200
+++ tmp/drivers/net/wireless/bcm43xx/bcm43xx_main.c	2006-06-18 19:02:19.000000000 +0200
@@ -1870,6 +1870,15 @@
 
 	spin_lock(&bcm->_lock);
 
+	/* Only accept IRQs, if we are initialized properly.
+	 * This avoids an RX race while initializing.
+	 * We should probably not enable IRQs before we are initialized
+	 * completely, but some careful work is needed to fix this. I think it
+	 * is best to stay with this cheap workaround for now... .
+	 */
+	if (unlikely(!bcm->initialized))
+		goto out;
+
 	reason = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
 	if (reason == 0xffffffff) {
 		/* irq not for us (shared irq) */
@@ -1891,20 +1900,11 @@
 
 	bcm43xx_interrupt_ack(bcm, reason);
 
-	/* Only accept IRQs, if we are initialized properly.
-	 * This avoids an RX race while initializing.
-	 * We should probably not enable IRQs before we are initialized
-	 * completely, but some careful work is needed to fix this. I think it
-	 * is best to stay with this cheap workaround for now... .
-	 */
-	if (likely(bcm->initialized)) {
-		/* disable all IRQs. They are enabled again in the bottom half. */
-		bcm->irq_savedstate = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
-		/* save the reason code and call our bottom half. */
-		bcm->irq_reason = reason;
-		tasklet_schedule(&bcm->isr_tasklet);
-	}
-
+	/* disable all IRQs. They are enabled again in the bottom half. */
+	bcm->irq_savedstate = bcm43xx_interrupt_disable(bcm, BCM43xx_IRQ_ALL);
+	/* save the reason code and call our bottom half. */
+	bcm->irq_reason = reason;
+	tasklet_schedule(&bcm->isr_tasklet);
 out:
 	mmiowb();
 	spin_unlock(&bcm->_lock);


-- 
Greetings Michael.

Re: Linux 2.6.17.1

[Chris Wright]

* Michael Buesch (mb@bu3sch.de) wrote:
> On Tuesday 20 June 2006 12:13, Chris Wright wrote:
> > We (the -stable team) are announcing the release of the 2.6.17.1 kernel.
> 
> Please consider inclusion of the following patch into 2.6.17.2:
> 
> It fixes a possible crash. Might be triggerable in networks with
> heavy traffic. I only saw it once so far, though.

I didn't notice that it made it to Linus' tree yet.  Can you make sure
to push it up, and I'll queue it for -stable.

thanks,
-chris

Re: Linux 2.6.17.1

[Michael Buesch]

On Tuesday 20 June 2006 12:44, Chris Wright wrote:
> * Michael Buesch (mb@bu3sch.de) wrote:
> > On Tuesday 20 June 2006 12:13, Chris Wright wrote:
> > > We (the -stable team) are announcing the release of the 2.6.17.1 kernel.
> > 
> > Please consider inclusion of the following patch into 2.6.17.2:
> > 
> > It fixes a possible crash. Might be triggerable in networks with
> > heavy traffic. I only saw it once so far, though.
> 
> I didn't notice that it made it to Linus' tree yet.  Can you make sure
> to push it up, and I'll queue it for -stable.

It is in -mm and I think John Linville also queued it upstream
through Jeff to Linus.
>From my perspective, everything is done ;)

-- 
Greetings Michael.

Re: Linux 2.6.17.1

[Chris Wright]

* Michael Buesch (mb@bu3sch.de) wrote:
> It is in -mm and I think John Linville also queued it upstream
> through Jeff to Linus.
> From my perspective, everything is done ;)

Sounds good, thanks.
-chris

Re: Linux 2.6.17.1

[John W. Linville]

On Tue, Jun 20, 2006 at 12:56:26PM +0200, Michael Buesch wrote:
> On Tuesday 20 June 2006 12:44, Chris Wright wrote:
> > * Michael Buesch (mb@bu3sch.de) wrote:
> > > On Tuesday 20 June 2006 12:13, Chris Wright wrote:
> > > > We (the -stable team) are announcing the release of the 2.6.17.1 kernel.
> > > 
> > > Please consider inclusion of the following patch into 2.6.17.2:
> > > 
> > > It fixes a possible crash. Might be triggerable in networks with
> > > heavy traffic. I only saw it once so far, though.
> > 
> > I didn't notice that it made it to Linus' tree yet.  Can you make sure
> > to push it up, and I'll queue it for -stable.
> 
> It is in -mm and I think John Linville also queued it upstream
> through Jeff to Linus.
> >From my perspective, everything is done ;)

I haven't quite done my part yet, but I intend to do so.  I think
this is a fine candidate for -stable.

John
-- 
John W. Linville
linville@tuxdriver.com