Linux 2.6.22.1

Linux 2.6.22.1

[Greg KH]

We (the -stable team) are announcing the release of the 2.6.22.1 kernel.
It contains a security fix for SCTP that somehow forgot to be added to
the 2.6.22 kernel (was already released in the 2.6.21.y releases).
Thanks to Patrick McHardy for noticing the mistake.

I'll also be replying to this message with a copy of the patch between
2.6.22 and 2.6.22.1

The updated 2.6.22.y git tree can be found at:
        git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
and can be browsed at the normal kernel.org git web browser:
        http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.22.y.git;a=summary

thanks,

greg k-h

---------

 Makefile                                |    2 +-
 net/netfilter/nf_conntrack_proto_sctp.c |    3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

Summary of changes from v2.6.22 to v2.6.22.1
============================================

Greg Kroah-Hartman (1):
      Linux 2.6.22.1

Patrick McHardy (1):
      NETFILTER: {ip, nf}_conntrack_sctp: fix remotely triggerable NULL ptr dereference (CVE-2007-2876)

Re: Linux 2.6.22.1

[Greg KH]

diff --git a/Makefile b/Makefile
index de4f8f7..e28395a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 22
-EXTRAVERSION =
+EXTRAVERSION = .1
 NAME = Holy Dancing Manatees, Batman!
 
 # *DOCUMENTATION*
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 0d3254b..6e41ba5 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -460,7 +460,8 @@ static int sctp_new(struct nf_conn *conntrack, const struct sk_buff *skb,
 					 SCTP_CONNTRACK_NONE, sch->type);
 
 		/* Invalid: delete conntrack */
-		if (newconntrack == SCTP_CONNTRACK_MAX) {
+		if (newconntrack == SCTP_CONNTRACK_NONE ||
+		    newconntrack == SCTP_CONNTRACK_MAX) {
 			DEBUGP("nf_conntrack_sctp: invalid new deleting.\n");
 			return 0;
 		}

Re: Linux 2.6.22.1

[Nish Aravamudan]

On 7/10/07, Greg KH <greg@kroah.com> wrote:
> We (the -stable team) are announcing the release of the 2.6.22.1 kernel.
> It contains a security fix for SCTP that somehow forgot to be added to
> the 2.6.22 kernel (was already released in the 2.6.21.y releases).
> Thanks to Patrick McHardy for noticing the mistake.
>
> I'll also be replying to this message with a copy of the patch between
> 2.6.22 and 2.6.22.1
>
> The updated 2.6.22.y git tree can be found at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git

Can you please also update

 git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6-stable.git

? Maybe make that update part of whatever process you use to push out
the 2.6.Y trees, as I've had to ask for this more than once now?

Thanks,
Nish

Re: [stable] Linux 2.6.22.1

[Greg KH]

On Thu, Jul 12, 2007 at 11:35:41AM -0700, Nish Aravamudan wrote:
> On 7/10/07, Greg KH <greg@kroah.com> wrote:
> > We (the -stable team) are announcing the release of the 2.6.22.1 kernel.
> > It contains a security fix for SCTP that somehow forgot to be added to
> > the 2.6.22 kernel (was already released in the 2.6.21.y releases).
> > Thanks to Patrick McHardy for noticing the mistake.
> >
> > I'll also be replying to this message with a copy of the patch between
> > 2.6.22 and 2.6.22.1
> >
> > The updated 2.6.22.y git tree can be found at:
> >         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
> 
> Can you please also update
> 
>  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6-stable.git
> 
> ? Maybe make that update part of whatever process you use to push out
> the 2.6.Y trees, as I've had to ask for this more than once now?

That is a tree that Chris did, and I didn't realize we were maintaining
it as the "official" stable tree, that is why it is not mentioned in the
release notes :)

I'll let Chris decide if he wishes to maintain it or not, Chris?

thanks,

greg k-h

Re: [stable] Linux 2.6.22.1

[Nish Aravamudan]

On 7/12/07, Greg KH <greg@kroah.com> wrote:
> On Thu, Jul 12, 2007 at 11:35:41AM -0700, Nish Aravamudan wrote:
> > On 7/10/07, Greg KH <greg@kroah.com> wrote:
> > > We (the -stable team) are announcing the release of the 2.6.22.1 kernel.
> > > It contains a security fix for SCTP that somehow forgot to be added to
> > > the 2.6.22 kernel (was already released in the 2.6.21.y releases).
> > > Thanks to Patrick McHardy for noticing the mistake.
> > >
> > > I'll also be replying to this message with a copy of the patch between
> > > 2.6.22 and 2.6.22.1
> > >
> > > The updated 2.6.22.y git tree can be found at:
> > >         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
> >
> > Can you please also update
> >
> >  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6-stable.git
> >
> > ? Maybe make that update part of whatever process you use to push out
> > the 2.6.Y trees, as I've had to ask for this more than once now?
>
> That is a tree that Chris did, and I didn't realize we were maintaining
> it as the "official" stable tree, that is why it is not mentioned in the
> release notes :)

Fair enough -- it's just a little bit easier from my side for
mirroring to only have to mirror one tree rather simply rather than
pulling multiple trees into one (and thus having to add to the list as
time goes on).

> I'll let Chris decide if he wishes to maintain it or not, Chris?

Thanks,
Nish

Re: [stable] Linux 2.6.22.1

[Chris Wright]

* Nish Aravamudan (nish.aravamudan@gmail.com) wrote:
> On 7/12/07, Greg KH <greg@kroah.com> wrote:
> > That is a tree that Chris did, and I didn't realize we were maintaining
> > it as the "official" stable tree, that is why it is not mentioned in the
> > release notes :)
> 
> Fair enough -- it's just a little bit easier from my side for
> mirroring to only have to mirror one tree rather simply rather than
> pulling multiple trees into one (and thus having to add to the list as
> time goes on).
> 
> > I'll let Chris decide if he wishes to maintain it or not, Chris?

Nish, I think you might be the only user ;-)  I never figured out a nice
way to do this w/out having a coherency issue (well, triggers aside).
Ideally git would allow for something more transparent than
alternatives, actual moving view to another tree.  It's possible with
links, but that seems just dirty.  Short of that, do folks find the tree
useful?  If so, I can work on some better automation to keep it
up-to-date.

thanks,
-chris

Re: [stable] Linux 2.6.22.1

[Nish Aravamudan]

On 7/12/07, Chris Wright <chrisw@sous-sol.org> wrote:
> * Nish Aravamudan (nish.aravamudan@gmail.com) wrote:
> > On 7/12/07, Greg KH <greg@kroah.com> wrote:
> > > That is a tree that Chris did, and I didn't realize we were maintaining
> > > it as the "official" stable tree, that is why it is not mentioned in the
> > > release notes :)
> >
> > Fair enough -- it's just a little bit easier from my side for
> > mirroring to only have to mirror one tree rather simply rather than
> > pulling multiple trees into one (and thus having to add to the list as
> > time goes on).
> >
> > > I'll let Chris decide if he wishes to maintain it or not, Chris?
>
> Nish, I think you might be the only user ;-)  I never figured out a nice
> way to do this w/out having a coherency issue (well, triggers aside).
> Ideally git would allow for something more transparent than
> alternatives, actual moving view to another tree.  It's possible with
> links, but that seems just dirty.  Short of that, do folks find the tree
> useful?  If so, I can work on some better automation to keep it
> up-to-date.

Well, if I'm the only one, I can work on something on my side :)
Thanks for the heads-up.

-Nish

Re: [stable] Linux 2.6.22.1

[Domenico Andreoli]

On Thu, Jul 12, 2007 at 11:52:19AM -0700, Chris Wright wrote:
> * Nish Aravamudan (nish.aravamudan@gmail.com) wrote:
> > On 7/12/07, Greg KH <greg@kroah.com> wrote:
> > > That is a tree that Chris did, and I didn't realize we were maintaining
> > > it as the "official" stable tree, that is why it is not mentioned in the
> > > release notes :)
> > 
> > Fair enough -- it's just a little bit easier from my side for
> > mirroring to only have to mirror one tree rather simply rather than
> > pulling multiple trees into one (and thus having to add to the list as
> > time goes on).
> > 
> > > I'll let Chris decide if he wishes to maintain it or not, Chris?
> 
> Nish, I think you might be the only user ;-)  I never figured out a nice
> way to do this w/out having a coherency issue (well, triggers aside).
> Ideally git would allow for something more transparent than
> alternatives, actual moving view to another tree.  It's possible with
> links, but that seems just dirty.  Short of that, do folks find the tree
> useful?  If so, I can work on some better automation to keep it
> up-to-date.

yes, please keep it (updated). i discovered it only few days ago...

many thanks anyway,
domenico

-----[ Domenico Andreoli, aka cavok
 --[ http://www.dandreoli.com/gpgkey.asc
   ---[ 3A0F 2F80 F79C 678A 8936  4FEE 0677 9033 A20E BC50

Re: [stable] Linux 2.6.22.1

[Rene Herman]

On 07/12/2007 08:52 PM, Chris Wright wrote:

> Nish, I think you might be the only user ;-)  I never figured out a nice 
> way to do this w/out having a coherency issue (well, triggers aside). 
> Ideally git would allow for something more transparent than alternatives,
> actual moving view to another tree.  It's possible with links, but that
> seems just dirty.  Short of that, do folks find the tree useful?  If so,
> I can work on some better automation to keep it up-to-date.

I tried this tree a while ago but at the time it had a problem with tags 
(http://lkml.org/lkml/2007/4/14/177). I just recloned and see that's now 
fixed...

I'm rolling my own since then though. Not sure, but perhaps it's interesting 
to someone: when Linus tags a release from his repo I branch of the -stable 
branch myself:

$ git checkout -b v22 v2.6.22

and then (following advice from Junio Hamano) add the following stanza to 
.git/config:

===
[branch "v22"]
         remote = linux-2.6.22.y
         merge = refs/heads/master
[remote "linux-2.6.22.y"]
         url = 
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
         fetch = refs/heads/master
===

(the url = is one line, but is wrapping).

When on this v22 branch, a simple "git pull" then updates from the stable 
tree. It's been working nicely for me. The manual .git/config editing is a 
little awkard perhaps but for all I know I could do so via some well-chosen 
git commands.

Rene.

Re: Linux 2.6.22.1

[Greg KH]

On Fri, Jul 13, 2007 at 02:16:20PM +0800, Bryan Wu wrote:
> On Fri, 2007-07-13 at 02:35 +0800, Nish Aravamudan wrote:
> > On 7/10/07, Greg KH <greg@kroah.com> wrote: 
> > > We (the -stable team) are announcing the release of the 2.6.22.1
> > kernel. 
> > > It contains a security fix for SCTP that somehow forgot to be added
> > to 
> > > the 2.6.22 kernel (was already released in the 2.6.21.y releases). 
> > > Thanks to Patrick McHardy for noticing the mistake. 
> > > 
> > > I'll also be replying to this message with a copy of the patch
> > between 
> > > 2.6.22 and 2.6.22.1 
> > > 
> > > The updated 2.6.22.y git tree can be found at: 
> > >
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
> > 
> > Can you please also update
> > 
> >  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6-stable.git
> > 
> > ? Maybe make that update part of whatever process you use to push out 
> > the 2.6.Y trees, as I've had to ask for this more than once now?
> > 
> 
> Could you please open http:// git-pull? I was blocked by company's
> firewall except http method -:((.

That is up to the kernel.org admins, but last time I checked, I think it
was enabled already.  Can you pull anything else from kernel.org with
http but not this tree?

thanks,

greg k-h

Re: Linux 2.6.22.1

[Bryan Wu]

On Fri, 2007-07-13 at 02:35 +0800, Nish Aravamudan wrote:
> On 7/10/07, Greg KH <greg@kroah.com> wrote: 
> > We (the -stable team) are announcing the release of the 2.6.22.1
> kernel. 
> > It contains a security fix for SCTP that somehow forgot to be added
> to 
> > the 2.6.22 kernel (was already released in the 2.6.21.y releases). 
> > Thanks to Patrick McHardy for noticing the mistake. 
> > 
> > I'll also be replying to this message with a copy of the patch
> between 
> > 2.6.22 and 2.6.22.1 
> > 
> > The updated 2.6.22.y git tree can be found at: 
> >
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
> 
> Can you please also update
> 
>  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6-stable.git
> 
> ? Maybe make that update part of whatever process you use to push out 
> the 2.6.Y trees, as I've had to ask for this more than once now?
> 

Could you please open http:// git-pull? I was blocked by company's
firewall except http method -:((.

Thanks a lot
-Bryan Wu

Re: Linux 2.6.22.1

[Bryan Wu]

On Thu, 2007-07-12 at 23:16 -0700, Greg KH wrote:
> On Fri, Jul 13, 2007 at 02:16:20PM +0800, Bryan Wu wrote:
> > On Fri, 2007-07-13 at 02:35 +0800, Nish Aravamudan wrote:
> > > On 7/10/07, Greg KH <greg@kroah.com> wrote: 
> > > > We (the -stable team) are announcing the release of the 2.6.22.1
> > > kernel. 
> > > > It contains a security fix for SCTP that somehow forgot to be added
> > > to 
> > > > the 2.6.22 kernel (was already released in the 2.6.21.y releases). 
> > > > Thanks to Patrick McHardy for noticing the mistake. 
> > > > 
> > > > I'll also be replying to this message with a copy of the patch
> > > between 
> > > > 2.6.22 and 2.6.22.1 
> > > > 
> > > > The updated 2.6.22.y git tree can be found at: 
> > > >
> > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
> > > 
> > > Can you please also update
> > > 
> > >  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6-stable.git
> > > 
> > > ? Maybe make that update part of whatever process you use to push out 
> > > the 2.6.Y trees, as I've had to ask for this more than once now?
> > > 
> > 
> > Could you please open http:// git-pull? I was blocked by company's
> > firewall except http method -:((.
> 
> That is up to the kernel.org admins, but last time I checked, I think it
> was enabled already.  Can you pull anything else from kernel.org with
> http but not this tree?
> 

I can git-pull from Linus tree through http in my company, this one
can't. If it is not easy to open it by you guys, I have to git-pull at
home, -:))

Thanks anyway

- Bryan

Re: Linux 2.6.22.1

[Linus Torvalds]

On Fri, 13 Jul 2007, Bryan Wu wrote:
> 
> I can git-pull from Linus tree through http in my company, this one
> can't. If it is not easy to open it by you guys, I have to git-pull at
> home, -:))

In that case, it's almost certainly that that tree isn't doing the proper 
"git update-server-info" when people push to it.

Chris/Greg: just add a

	hooks/post-update

file to your git repo that is executable, and just contains

	#!/bin/sh
	exec git-update-server-info

in it, and you'll be golden. It will mean that every time you push to the 
repo, it will run the "git update-server-info" thing after the push. And 
that will update all the necessary files for the stupid protocols (ie 
http) that don't know about git natively.

Oh, and run the "git-update-server-info" once by hand, just so that you 
don't then have to wait until after the next push for the git repo to be 
accessible by http://

www.kernel.org serves git repos fine, but the git repos have to help a bit 
at doing so.

What git update-server-info does is to create "info/refs" and 
"objects/info/packs" files that contain enough information for a client to 
figure out what refs and pack objects exist, so that they can try to fetch 
the necessary data on their own.

		Linus

Re: Linux 2.6.22.1

[Adrian Bunk]

On Thu, Jul 12, 2007 at 11:16:17PM -0700, Greg KH wrote:
> On Fri, Jul 13, 2007 at 02:16:20PM +0800, Bryan Wu wrote:
> > On Fri, 2007-07-13 at 02:35 +0800, Nish Aravamudan wrote:
> > > On 7/10/07, Greg KH <greg@kroah.com> wrote: 
> > > > We (the -stable team) are announcing the release of the 2.6.22.1
> > > kernel. 
> > > > It contains a security fix for SCTP that somehow forgot to be added
> > > to 
> > > > the 2.6.22 kernel (was already released in the 2.6.21.y releases). 
> > > > Thanks to Patrick McHardy for noticing the mistake. 
> > > > 
> > > > I'll also be replying to this message with a copy of the patch
> > > between 
> > > > 2.6.22 and 2.6.22.1 
> > > > 
> > > > The updated 2.6.22.y git tree can be found at: 
> > > >
> > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
> > > 
> > > Can you please also update
> > > 
> > >  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6-stable.git
> > > 
> > > ? Maybe make that update part of whatever process you use to push out 
> > > the 2.6.Y trees, as I've had to ask for this more than once now?
> > > 
> > 
> > Could you please open http:// git-pull? I was blocked by company's
> > firewall except http method -:((.
> 
> That is up to the kernel.org admins, but last time I checked, I think it
> was enabled already.  Can you pull anything else from kernel.org with
> http but not this tree?

I found the problem and (ab)used my kstable group rights to fix it:

objects/info/alternates of linux-2.6.22.y.git contained
  /home/ftp/pub/scm/linux/kernel/git/torvalds/linux-2.6.git/objects
instead of
  /pub/scm/linux/kernel/git/torvalds/linux-2.6.git/objects

This seems to exist on git.kernel.org but not on www.kernel.org, 
explaining why the http method didn't work.

> thanks,
> 
> greg k-h

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: Linux 2.6.22.1

[Chris Wright]

* Linus Torvalds (torvalds@linux-foundation.org) wrote:
> In that case, it's almost certainly that that tree isn't doing the proper 
> "git update-server-info" when people push to it.

Yup, should be fixed now.

thanks,
-chris

Re: Linux 2.6.22.1

[Bryan Wu]

On Thu, 2007-07-12 at 23:51 -0700, Chris Wright wrote:
> * Linus Torvalds (torvalds@linux-foundation.org) wrote:
> > In that case, it's almost certainly that that tree isn't doing the proper 
> > "git update-server-info" when people push to it.
> 
> Yup, should be fixed now.
> 
> thanks,
> -chris

Thanks a lot. With you guys help, it is  works.
- Bryan

Re: Linux 2.6.22.1

[Greg KH]

On Fri, Jul 13, 2007 at 08:47:51AM +0200, Adrian Bunk wrote:
> On Thu, Jul 12, 2007 at 11:16:17PM -0700, Greg KH wrote:
> > On Fri, Jul 13, 2007 at 02:16:20PM +0800, Bryan Wu wrote:
> > > On Fri, 2007-07-13 at 02:35 +0800, Nish Aravamudan wrote:
> > > > On 7/10/07, Greg KH <greg@kroah.com> wrote: 
> > > > > We (the -stable team) are announcing the release of the 2.6.22.1
> > > > kernel. 
> > > > > It contains a security fix for SCTP that somehow forgot to be added
> > > > to 
> > > > > the 2.6.22 kernel (was already released in the 2.6.21.y releases). 
> > > > > Thanks to Patrick McHardy for noticing the mistake. 
> > > > > 
> > > > > I'll also be replying to this message with a copy of the patch
> > > > between 
> > > > > 2.6.22 and 2.6.22.1 
> > > > > 
> > > > > The updated 2.6.22.y git tree can be found at: 
> > > > >
> > > > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.22.y.git
> > > > 
> > > > Can you please also update
> > > > 
> > > >  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6-stable.git
> > > > 
> > > > ? Maybe make that update part of whatever process you use to push out 
> > > > the 2.6.Y trees, as I've had to ask for this more than once now?
> > > > 
> > > 
> > > Could you please open http:// git-pull? I was blocked by company's
> > > firewall except http method -:((.
> > 
> > That is up to the kernel.org admins, but last time I checked, I think it
> > was enabled already.  Can you pull anything else from kernel.org with
> > http but not this tree?
> 
> I found the problem and (ab)used my kstable group rights to fix it:
> 
> objects/info/alternates of linux-2.6.22.y.git contained
>   /home/ftp/pub/scm/linux/kernel/git/torvalds/linux-2.6.git/objects
> instead of
>   /pub/scm/linux/kernel/git/torvalds/linux-2.6.git/objects
> 
> This seems to exist on git.kernel.org but not on www.kernel.org, 
> explaining why the http method didn't work.

Odd, thanks for fixing that, it was "interesting" to create that tree
and it took me a few tries as I forgot to clone it right when Linus
released so I had to reset the HEAD back to the v2.6.22 release
changeset.

thanks,

greg k-h

Re: Linux 2.6.22.1

[H. Peter Anvin]

Adrian Bunk wrote:
> 
> I found the problem and (ab)used my kstable group rights to fix it:
> 
> objects/info/alternates of linux-2.6.22.y.git contained
>   /home/ftp/pub/scm/linux/kernel/git/torvalds/linux-2.6.git/objects
> instead of
>   /pub/scm/linux/kernel/git/torvalds/linux-2.6.git/objects
> 
> This seems to exist on git.kernel.org but not on www.kernel.org, 
> explaining why the http method didn't work.
> 

No, it's because the /home/ftp/pub/... path isn't visible to the http
namespace.

	-hpa