kernel/linux.git, branch v2.6.16.55

Linux 2.6.16.55

2007-10-12T21:03:33+00:00

Revert "TCP: Fix TCP handling of SACK in bidirectional flows"

2007-10-12T21:03:25+00:00

This reverts commit 3198d0f16dec0c87071cf26f3f11af9c8f0a009b.

Linux 2.6.16.55-rc1

2007-10-07T01:27:01+00:00

Convert snd-page-alloc proc file to use seq_file (CVE-2007-4571)

2007-10-07T01:26:43+00:00

Commit ccec6e2c4a74adf76ed4e2478091a311b1806212 in mainline. Use seq_file for the proc file read/write of snd-page-alloc module. This automatically fixes bugs in the old proc code. Adrian Bunk: Backported to 2.6.16. Signed-off-by: Takashi Iwai Signed-off-by: Adrian Bunk

snd_mem_proc_read(): convert to list_for_each_entry*

2007-10-06T22:58:15+00:00

Stolen from a patch by Johannes Berg . Signed-off-by: Adrian Bunk

sysfs: store sysfs inode nrs in s_ino to avoid readdir oopses (CVE-2007-3104)

2007-10-06T22:52:10+00:00

Backport of ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.22-rc1/2.6.22-rc1-mm1/broken-out/gregkh-driver-sysfs-allocate-inode-number-using-ida.patch For regular files in sysfs, sysfs_readdir wants to traverse sysfs_dirent->s_dentry->d_inode->i_ino to get to the inode number. But, the dentry can be reclaimed under memory pressure, and there is no synchronization with readdir. This patch follows Tejun's scheme of allocating and storing an inode number in the new s_ino member of a sysfs_dirent, when dirents are created, and retrieving it from there for readdir, so that the pointer chain doesn't have to be traversed. Tejun's upstream patch uses a new-ish "ida" allocator which brings along some extra complexity; this -stable patch has a brain-dead incrementing counter which does not guarantee uniqueness, but because sysfs doesn't hash inodes as iunique expects, uniqueness wasn't guaranteed today anyway. Adrian Bunk: Backported to 2.6.16. Signed-off-by: Eric Sandeen Signed-off-by: Adrian Bunk

random: fix bound check ordering (CVE-2007-3105)

2007-10-06T22:27:53+00:00

If root raised the default wakeup threshold over the size of the output pool, the pool transfer function could overflow the stack with RNG bytes, causing a DoS or potential privilege escalation. (Bug reported by the PaX Team ) Signed-off-by: Matt Mackall Signed-off-by: Adrian Bunk

random: fix seeding with zero entropy (CVE-2007-2453 2 of 2)

2007-10-06T22:24:49+00:00

Add data from zero-entropy random_writes directly to output pools to avoid accounting difficulties on machines without entropy sources. Tested on lguest with all entropy sources disabled. Signed-off-by: Matt Mackall Acked-by: Theodore Ts'o Signed-off-by: Adrian Bunk

random: fix error in entropy extraction (CVE-2007-2453 1 of 2)

2007-10-06T22:19:10+00:00

Fix cast error in entropy extraction. Add comments explaining the magic 16. Remove extra confusing loop variable. Signed-off-by: Matt Mackall Acked-by: Theodore Ts'o Signed-off-by: Adrian Bunk

Reset current->pdeath_signal on SUID binary execution (CVE-2007-3848)

2007-10-06T22:03:26+00:00

This fixes a vulnerability in the "parent process death signal" implementation discoverd by Wojciech Purczynski of COSEINC PTE Ltd. and iSEC Security Research. http://marc.info/?l=bugtraq&m=118711306802632&w=2 Signed-off-by: Marcel Holtmann Signed-off-by: Adrian Bunk