Re: [stable] [patch 37/37] sit: fix off-by-one inipip6_tunnel_get_prl

Greg KH
2009-10-13T00:04:16Z

On Mon, Oct 12, 2009 at 04:29:53PM -0700, Templin, Fred L wrote:
> Greg,
>
> > -----Original Message-----
> > From: Greg KH [mailto:greg@kroah.com]
> > Sent: Monday, October 12, 2009 3:05 PM
> > To: David Miller
> > Cc: Templin, Fred L; contact@saschahlusiak.de; yoshfuji@linux-ipv6.org; gregkh@suse.de; linux-
> > kernel@vger.kernel.org; stable@kernel.org; akpm@linux-foundation.org; torvalds@linux-foundation.org;
> > stable-review@kernel.org; alan@lxorguk.ukuu.org.uk
> > Subject: Re: [stable] [patch 37/37] sit: fix off-by-one inipip6_tunnel_get_prl
> >
> > On Fri, Oct 09, 2009 at 08:42:31PM -0700, David Miller wrote:
> > > From: "Templin, Fred L" <Fred.L.Templin@boeing.com>
> > > Date: Fri, 9 Oct 2009 17:34:49 -0700
> > >
> > > > Wait a moment - I remember now that this code came
> > > > from Yoshifuji, and I believe there was a reason for
> > > > the cmax+1. The application is expected to know this
> > > > and to post a large enough buffer.
> > > >
> > > > Can we put this on hold until I have had a chance to
> > > > check my e-mail archives and my local iproute changes
> > > > (will respond on monday)?
> > >
> > > Sure, we can keep it out of -stable for now.
> > >
> > > But it is in Linus's tree so if you find we shouldn't do this
> > > you'll need to send me a revert for net-2.6
> > >
> > > Otherwise if it's good, you'll have to remind me to resubmit
> > > it to -stable.
> >
> > Ah crap, I just commited it.
> >
> > Is it really broken? If so, I'll go revert it and cut a new release.
> >
> > Sorry about this.
>
> As I just mentioned to David, I tested and the patch is
> good. To test, I allocated a buffer in the application
> that was too small to hold the entire PRL. Without the
> patch, the system crashes. With the patch, the kernel
> returns the maximum number of PRL entries without
> crashing and without overrunning the application's buffer.
>
> Please apply the patch if you have not already done so.

Which patch? I need it to be in Linus's tree before we can apply it to
a stable release.

thanks,

greg k-h