linux-stable.git/net, branch linux-2.6.18.y

[PATCH] Bluetooth: Add packet size checks for CAPI messages (CVE-2006-6106)

2006-12-17T00:20:48+00:00

With malformed packets it might be possible to overwrite internal
CMTP and CAPI data structures. This patch adds additional length
checks to prevent these kinds of remote attacks.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Chris Wright

[PATCH] IrDA: Incorrect TTP header reservation

2006-12-17T00:20:47+00:00

We must reserve SAR + MAX_HEADER bytes for IrLMP to fit in.
This fixes an oops reported (and fixed) by Jeet Chaudhuri, when max_sdu_size
is greater than 0.

Signed-off-by: Samuel Ortiz 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] IPSEC: Fix inetpeer leak in ipv4 xfrm dst entries.

2006-12-17T00:20:47+00:00

We grab a reference to the route's inetpeer entry but
forget to release it in xfrm4_dst_destroy().

Bug discovered by Kazunori MIYAZAWA 

Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] XFRM: Use output device disable_xfrm for forwarded packets

2006-12-17T00:20:47+00:00

Currently the behaviour of disable_xfrm is inconsistent between
locally generated and forwarded packets. For locally generated
packets disable_xfrm disables the policy lookup if it is set on
the output device, for forwarded traffic however it looks at the
input device. This makes it impossible to disable xfrm on all
devices but a dummy device and use normal routing to direct
traffic to that device.

Always use the output device when checking disable_xfrm.

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] PKT_SCHED act_gact: division by zero

2006-12-17T00:20:47+00:00

Not returning -EINVAL, because someone might want to use the value
zero in some future gact_prob algorithm?

Signed-off-by: Kim Nordlund 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] NETFILTER: ip_tables: revision support for compat code

2006-12-17T00:20:46+00:00

Signed-off-by: Patrick McHardy 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] NET_SCHED: policer: restore compatibility with old iproute binaries

2006-12-17T00:20:46+00:00

The tc actions increased the size of struct tc_police, which broke
compatibility with old iproute binaries since both the act_police
and the old NET_CLS_POLICE code check for an exact size match.

Since the new members are not even used, the simple fix is to also
accept the size of the old structure. Dumping is not affected since
old userspace will receive a bigger structure, which is handled fine.

Signed-off-by: Patrick McHardy 
Acked-by: Jamal Hadi Salim 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] EBTABLES: Prevent wraparounds in checks for entry components' sizes.

2006-12-17T00:20:46+00:00

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] EBTABLES: Deal with the worst-case behaviour in loop checks.

2006-12-17T00:20:46+00:00

No need to revisit a chain we'd already finished with during
the check for current hook.  It's either instant loop (which
we'd just detected) or a duplicate work.

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright

[PATCH] EBTABLES: Verify that ebt_entries have zero ->distinguisher.

2006-12-17T00:20:46+00:00

We need that for iterator to work; existing check had been too weak.

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller 
Signed-off-by: Chris Wright