lkml.org 
[lkml]   [2011]   [Aug]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [00/19] 2.6.32.46-longterm review
    On 08/27/2011 01:01 AM, Greg KH wrote:
    > This is the start of the longterm review cycle for the 2.6.32.46 release.
    > There are 19 patches in this series, all will be posted as a response
    > to this one. If anyone has any issues with these being applied, please
    > let us know. If anyone is a maintainer of the proper subsystem, and
    > wants to add a Signed-off-by: line to the patch, please respond with it.
    >
    > Responses should be made by Monday, August 29, 2011, 12:00:00 UTC.
    > Anything received after that time might be too late.
    >
    > The whole patch series can be found in one patch at:
    > kernel.org/pub/linux/kernel/v2.6/longterm-review/patch-2.6.32.46-rc1.gz
    > and the diffstat can be found below.
    >
    > thanks,
    >
    > greg k-h
    Hi,

    upstream commit d5aa407f59f5b83d2c50ec88f5bf56d40f1f8978 ("tunnels: fix
    netns vs proto registration ordering") , which was included in
    2.6.32.44-longterm, was not backported correctly, and results in a NULL
    pointer dereference in ip6_tunnel.c for longterm kernels 2.6.32.44 and
    2.6.32.45.

    The bug has been reported at the Gentoo [1] and Debian [2] bugzillas,
    and fixed in the latest grsec-patches [3], but I haven't found a report
    for this at the lkml (or at the kernel's bugzilla).

    The fix is trivial, and I think it can be included in 2.6.32.46, if
    possible.
    If you want, I can submit it with a new email to stable@kernel.org.

    diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
    index 7fb3e02..53e0d51 100644
    --- a/net/ipv6/ip6_tunnel.c
    +++ b/net/ipv6/ip6_tunnel.c
    @@ -1466,7 +1466,7 @@ static int __init ip6_tunnel_init(void)
    {
    int err;

    - err = register_pernet_device(&ip6_tnl_net_ops);
    + err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops);
    if (err < 0)
    goto out_pernet;

    Btw, this has been fixed in grsec-patches, and an identical patch has
    also been posted at the Debian bugzilla, so I'm not sure about the
    Signed-off-by and Reported-by tags.
    [1] https://bugs.gentoo.org/show_bug.cgi?id=380609
    [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633738
    [3] http://grsecurity.net/changelog-stable.txt

    --
    Stratos Psomadakis
    <psomas@gentoo.org>



    \
     
     \ /
      Last update: 2011-08-28 14:37    [W:3.020 / U:2.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site