Author: maks-guest
Date: Tue Feb 20 11:44:20 2007
New Revision: 8315
Added:
dists/sid/linux-2.6/debian/patches/bugfix/nfs-acl-free-wrong-pointer.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/11
Log:
add 2.6.18.7 nfs acl security fix
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog (original)
+++ dists/sid/linux-2.6/debian/changelog Tue Feb 20 11:44:20 2007
@@ -24,8 +24,10 @@
* Forward port complete IPX checksum patch 2.6.16.34
* From the 2.6.18 stable queue:
- IB/mad: Fix race between cancel and receive completion
+ * Add 2.6.18.7, thanks gregkh:
+ - Fix a free-wrong-pointer bug in nfs/acl server (CVE-2007-0772)
- -- maximilian attems <[EMAIL PROTECTED]> Mon, 19 Feb 2007 17:31:22 +0100
+ -- maximilian attems <[EMAIL PROTECTED]> Tue, 20 Feb 2007 11:41:20 +0100
linux-2.6 (2.6.18.dfsg.1-10) unstable; urgency=low
Added:
dists/sid/linux-2.6/debian/patches/bugfix/nfs-acl-free-wrong-pointer.patch
==============================================================================
--- (empty file)
+++ dists/sid/linux-2.6/debian/patches/bugfix/nfs-acl-free-wrong-pointer.patch
Tue Feb 20 11:44:20 2007
@@ -0,0 +1,45 @@
+diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
+index fc95c4d..c318b6f 100644
+--- a/fs/nfsd/nfs2acl.c
++++ b/fs/nfsd/nfs2acl.c
+@@ -287,13 +287,20 @@ static int nfsaclsvc_release_getacl(struct svc_rqst
*rqstp, u32 *p,
+ return 1;
+ }
+
+-static int nfsaclsvc_release_fhandle(struct svc_rqst *rqstp, u32 *p,
+- struct nfsd_fhandle *resp)
++static int nfsaclsvc_release_attrstat(struct svc_rqst *rqstp, u32 *p,
++ struct nfsd_attrstat *resp)
+ {
+ fh_put(&resp->fh);
+ return 1;
+ }
+
++static int nfsaclsvc_release_access(struct svc_rqst *rqstp, u32 *p,
++ struct nfsd3_accessres *resp)
++{
++ fh_put(&resp->fh);
++ return 1;
++}
++
+ #define nfsaclsvc_decode_voidargs NULL
+ #define nfsaclsvc_encode_voidres NULL
+ #define nfsaclsvc_release_void NULL
+@@ -322,9 +329,9 @@ struct nfsd3_voidargs { int dummy; };
+ static struct svc_procedure nfsd_acl_procedures2[] = {
+ PROC(null, void, void, void, RC_NOCACHE, ST),
+ PROC(getacl, getacl, getacl, getacl, RC_NOCACHE,
ST+1+2*(1+ACL)),
+- PROC(setacl, setacl, attrstat, fhandle, RC_NOCACHE,
ST+AT),
+- PROC(getattr, fhandle, attrstat, fhandle, RC_NOCACHE, ST+AT),
+- PROC(access, access, access, fhandle, RC_NOCACHE,
ST+AT+1),
++ PROC(setacl, setacl, attrstat, attrstat, RC_NOCACHE,
ST+AT),
++ PROC(getattr, fhandle, attrstat, attrstat, RC_NOCACHE, ST+AT),
++ PROC(access, access, access, access, RC_NOCACHE,
ST+AT+1),
+ };
+
+ struct svc_version nfsd_acl_version2 = {
+-
+To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
+the body of a message to [EMAIL PROTECTED]
+More majordomo info at http://vger.kernel.org/majordomo-info.html
+Please read the FAQ at http://www.tux.org/lkml/
Modified: dists/sid/linux-2.6/debian/patches/series/11
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/11 (original)
+++ dists/sid/linux-2.6/debian/patches/series/11 Tue Feb 20 11:44:20 2007
@@ -5,3 +5,4 @@
+ bugfix/net-ipx-annotation-checksum.patch
+ bugfix/ib-mad-fix-race-between-cancel-and-receive-completion.patch
+ bugfix/sparc/sbus-envctrl-remove-execve.patch
++ bugfix/nfs-acl-free-wrong-pointer.patch
_______________________________________________
Kernel-svn-changes mailing list
[email protected]
http://lists.alioth.debian.org/mailman/listinfo/kernel-svn-changes
