1. 07 Mar, 2011 1 commit
  2. 06 Mar, 2011 3 commits
  3. 05 Mar, 2011 17 commits
  4. 04 Mar, 2011 11 commits
  5. 03 Mar, 2011 8 commits
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of... · b65a0e0c
      Linus Torvalds authored
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
        DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076]
      b65a0e0c
    • Linus Torvalds's avatar
      Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 · 4438a02f
      Linus Torvalds authored
      * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits)
        MAINTAINERS: Add Andy Gospodarek as co-maintainer.
        r8169: disable ASPM
        RxRPC: Fix v1 keys
        AF_RXRPC: Handle receiving ACKALL packets
        cnic: Fix lost interrupt on bnx2x
        cnic: Prevent status block race conditions with hardware
        net: dcbnl: check correct ops in dcbnl_ieee_set()
        e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead
        igb: fix sparse warning
        e1000: fix sparse warning
        netfilter: nf_log: avoid oops in (un)bind with invalid nfproto values
        dccp: fix oops on Reset after close
        ipvs: fix dst_lock locking on dest update
        davinci_emac: Add Carrier Link OK check in Davinci RX Handler
        bnx2x: update driver version to 1.62.00-6
        bnx2x: properly calculate lro_mss
        bnx2x: perform statistics "action" before state transition.
        bnx2x: properly configure coefficients for MinBW algorithm (NPAR mode).
        bnx2x: Fix ethtool -t link test for MF (non-pmf) devices.
        bnx2x: Fix nvram test for single port devices.
        ...
      4438a02f
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block · fb4b10ab
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.dk/linux-2.6-block:
        block: kill loop_mutex
        blktrace: Remove blk_fill_rwbs_rq.
        block: blk-flush shouldn't call directly into q->request_fn() __blk_run_queue()
        block: add @force_kblockd to __blk_run_queue()
        block: fix kernel-doc format for blkdev_issue_zeroout
        blk-throttle: Do not use kblockd workqueue for throtl work
      fb4b10ab
    • Linus Torvalds's avatar
      Merge branch 'i_nlink' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 · 83360269
      Linus Torvalds authored
      * 'i_nlink' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
        hfs: fix rename() over non-empty directory
        udf: fix i_nlink limit
        fix reiserfs mkdir() breakage
        exofs: i_nlink races in rename()
        nilfs2: i_nlink races in rename()
        minix: i_nlink races in rename()
        ufs: i_nlink races in rename()
        sysv: i_nlink races in rename()
      83360269
    • David Howells's avatar
      DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076] · 1362fa07
      David Howells authored
      When a DNS resolver key is instantiated with an error indication, attempts to
      read that key will result in an oops because user_read() is expecting there to
      be a payload - and there isn't one [CVE-2011-1076].
      
      Give the DNS resolver key its own read handler that returns the error cached in
      key->type_data.x[0] as an error rather than crashing.
      
      Also make the kenter() at the beginning of dns_resolver_instantiate() limit the
      amount of data it prints, since the data is not necessarily NUL-terminated.
      
      The buggy code was added in:
      
      	commit 4a2d7892
      	Author: Wang Lei <wang840925@gmail.com>
      	Date:   Wed Aug 11 09:37:58 2010 +0100
      	Subject: DNS: If the DNS server returns an error, allow that to be cached [ver #2]
      
      This can trivially be reproduced by any user with the following program
      compiled with -lkeyutils:
      
      	#include <stdlib.h>
      	#include <keyutils.h>
      	#include <err.h>
      	static char payload[] = "#dnserror=6";
      	int main()
      	{
      		key_serial_t key;
      		key = add_key("dns_resolver", "a", payload, sizeof(payload),
      			      KEY_SPEC_SESSION_KEYRING);
      		if (key == -1)
      			err(1, "add_key");
      		if (keyctl_read(key, NULL, 0) == -1)
      			err(1, "read_key");
      		return 0;
      	}
      
      What should happen is that keyctl_read() reports error 6 (ENXIO) to the user:
      
      	dns-break: read_key: No such device or address
      
      but instead the kernel oopses.
      
      This cannot be reproduced with the 'keyutils add' or 'keyutils padd' commands
      as both of those cut the data down below the NUL termination that must be
      included in the data.  Without this dns_resolver_instantiate() will return
      -EINVAL and the key will not be instantiated such that it can be read.
      
      The oops looks like:
      
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
      IP: [<ffffffff811b99f7>] user_read+0x4f/0x8f
      PGD 3bdf8067 PUD 385b9067 PMD 0
      Oops: 0000 [#1] SMP
      last sysfs file: /sys/devices/pci0000:00/0000:00:19.0/irq
      CPU 0
      Modules linked in:
      
      Pid: 2150, comm: dns-break Not tainted 2.6.38-rc7-cachefs+ #468                  /DG965RY
      RIP: 0010:[<ffffffff811b99f7>]  [<ffffffff811b99f7>] user_read+0x4f/0x8f
      RSP: 0018:ffff88003bf47f08  EFLAGS: 00010246
      RAX: 0000000000000001 RBX: ffff88003b5ea378 RCX: ffffffff81972368
      RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003b5ea378
      RBP: ffff88003bf47f28 R08: ffff88003be56620 R09: 0000000000000000
      R10: 0000000000000395 R11: 0000000000000002 R12: 0000000000000000
      R13: 0000000000000000 R14: 0000000000000000 R15: ffffffffffffffa1
      FS:  00007feab5751700(0000) GS:ffff88003e000000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000000010 CR3: 000000003de40000 CR4: 00000000000006f0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      Process dns-break (pid: 2150, threadinfo ffff88003bf46000, task ffff88003be56090)
      Stack:
       ffff88003b5ea378 ffff88003b5ea3a0 0000000000000000 0000000000000000
       ffff88003bf47f68 ffffffff811b708e ffff88003c442bc8 0000000000000000
       00000000004005a0 00007fffba368060 0000000000000000 0000000000000000
      Call Trace:
       [<ffffffff811b708e>] keyctl_read_key+0xac/0xcf
       [<ffffffff811b7c07>] sys_keyctl+0x75/0xb6
       [<ffffffff81001f7b>] system_call_fastpath+0x16/0x1b
      Code: 75 1f 48 83 7b 28 00 75 18 c6 05 58 2b fb 00 01 be bb 00 00 00 48 c7 c7 76 1c 75 81 e8 13 c2 e9 ff 4c 8b b3 e0 00 00 00 4d 85 ed <41> 0f b7 5e 10 74 2d 4d 85 e4 74 28 e8 98 79 ee ff 49 39 dd 48
      RIP  [<ffffffff811b99f7>] user_read+0x4f/0x8f
       RSP <ffff88003bf47f08>
      CR2: 0000000000000010
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Acked-by: default avatarJeff Layton <jlayton@redhat.com>
      cc: Wang Lei <wang840925@gmail.com>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      1362fa07
    • Sage Weil's avatar
      libceph: retry after authorization failure · 692d20f5
      Sage Weil authored
      If we mark the connection CLOSED we will give up trying to reconnect to
      this server instance.  That is appropriate for things like a protocol
      version mismatch that won't change until the server is restarted, at which
      point we'll get a new addr and reconnect.  An authorization failure like
      this is probably due to the server not properly rotating it's secret keys,
      however, and should be treated as transient so that the normal backoff and
      retry behavior kicks in.
      Signed-off-by: default avatarSage Weil <sage@newdream.net>
      692d20f5
    • Sage Weil's avatar
      libceph: fix handling of short returns from get_user_pages · 38815b78
      Sage Weil authored
      get_user_pages() can return fewer pages than we ask for.  We were returning
      a bogus pointer/error code in that case.  Instead, loop until we get all
      the pages we want or get an error we can return to the caller.
      Signed-off-by: default avatarSage Weil <sage@newdream.net>
      38815b78
    • Jay Vosburgh's avatar