lkml.org 
[lkml]   [2011]   [Aug]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [00/19] 2.6.32.46-longterm review
On 08/27/2011 01:01 AM, Greg KH wrote:
> This is the start of the longterm review cycle for the 2.6.32.46 release.
> There are 19 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let us know. If anyone is a maintainer of the proper subsystem, and
> wants to add a Signed-off-by: line to the patch, please respond with it.
>
> Responses should be made by Monday, August 29, 2011, 12:00:00 UTC.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v2.6/longterm-review/patch-2.6.32.46-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Hi,

upstream commit d5aa407f59f5b83d2c50ec88f5bf56d40f1f8978 ("tunnels: fix
netns vs proto registration ordering") , which was included in
2.6.32.44-longterm, was not backported correctly, and results in a NULL
pointer dereference in ip6_tunnel.c for longterm kernels 2.6.32.44 and
2.6.32.45.

The bug has been reported at the Gentoo [1] and Debian [2] bugzillas,
and fixed in the latest grsec-patches [3], but I haven't found a report
for this at the lkml (or at the kernel's bugzilla).

The fix is trivial, and I think it can be included in 2.6.32.46, if
possible.
If you want, I can submit it with a new email to stable@kernel.org.

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 7fb3e02..53e0d51 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1466,7 +1466,7 @@ static int __init ip6_tunnel_init(void)
{
int err;

- err = register_pernet_device(&ip6_tnl_net_ops);
+ err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops);
if (err < 0)
goto out_pernet;

Btw, this has been fixed in grsec-patches, and an identical patch has
also been posted at the Debian bugzilla, so I'm not sure about the
Signed-off-by and Reported-by tags.
[1] https://bugs.gentoo.org/show_bug.cgi?id=380609
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633738
[3] http://grsecurity.net/changelog-stable.txt

--
Stratos Psomadakis
<psomas@gentoo.org>



\
 
 \ /
  Last update: 2011-08-28 14:37    [from the cache]
©2003-2011 Jasper Spaans