source: patches/linux-2.6.24.7-security_fixes-1.patch@ dc4f9f2

fs/cifs/asn1.c

@@ -186 +186 @@
                         }
                 }
         }
+
+        /* don't trust len bigger than ctx buffer */
+        if (*len > ctx->end - ctx->pointer)
+                return 0;
+
         return 1;
 }
 
@@ -203 +208 @@
         if (!asn1_length_decode(ctx, &def, &len))
                 return 0;
 
+        /* primitive shall be definite, indefinite shall be constructed */
+        if (*con == ASN1_PRI && !def)
+                return 0;
+
         if (def)
                 *eoc = ctx->pointer + len;
         else
@@ -389 +398 @@
         unsigned long *optr;
 
         size = eoc - ctx->pointer + 1;
+
+        /* first subid actually encodes first two subids */
+        if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
+                return 0;
+
         *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
         if (*oid == NULL)
                 return 0;

net/ipv4/netfilter/nf_nat_snmp_basic.c

@@ -232 +232 @@
                         }
                 }
         }
+
+        /* don't trust len bigger than ctx buffer */
+        if (*len > ctx->end - ctx->pointer)
+                return 0;
+
         return 1;
 }
 
@@ -250 +255 @@
         if (!asn1_length_decode(ctx, &def, &len))
                 return 0;
 
+        /* primitive shall be definite, indefinite shall be constructed */
+        if (*con == ASN1_PRI && !def)
+                return 0;
+
         if (def)
                 *eoc = ctx->pointer + len;
         else
@@ -434 +443 @@
         unsigned long *optr;
 
         size = eoc - ctx->pointer + 1;
+
+        /* first subid actually encodes first two subids */
+        if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
+                return 0;
+
         *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
         if (*oid == NULL) {
                 if (net_ratelimit())

arch/x86/kernel/entry_64.S

@@ -779 +779 @@
         swapgs
 paranoid_restore\trace:
         RESTORE_ALL 8
-        iretq
+        jmp iret_label
 paranoid_userspace\trace:
         GET_THREAD_INFO(%rcx)
         movl threadinfo_flags(%rcx),%ebx

linux-source-2.6.24

@@ -395 +395 @@
         }
 
         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
-        kfree_skb(skb);
         read_unlock(&ipip6_lock);
 out:
+        kfree_skb(skb);
         return 0;
 }
 

arch/sparc/kernel/sys_sparc.c

@@ -219 +219 @@
         return err;
 }
 
-int sparc_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
+int sparc_mmap_check(unsigned long addr, unsigned long len)
 {
         if (ARCH_SUN4C_SUN4 &&
             (len > 0x20000000 ||
@@ -295 +295 @@
         unsigned long old_len, unsigned long new_len,
         unsigned long flags, unsigned long new_addr)
 {
-        struct vm_area_struct *vma;
         unsigned long ret = -EINVAL;
-        if (ARCH_SUN4C_SUN4) {
-                if (old_len > 0x20000000 || new_len > 0x20000000)
-                        goto out;
-                if (addr < 0xe0000000 && addr + old_len > 0x20000000)
-                        goto out;
-        }
-        if (old_len > TASK_SIZE - PAGE_SIZE ||
-            new_len > TASK_SIZE - PAGE_SIZE)
+
+        if (unlikely(sparc_mmap_check(addr, old_len)))
+                goto out;
+        if (unlikely(sparc_mmap_check(new_addr, new_len)))
                 goto out;
         down_write(&current->mm->mmap_sem);
-        if (flags & MREMAP_FIXED) {
-                if (ARCH_SUN4C_SUN4 &&
-                    new_addr < 0xe0000000 &&
-                    new_addr + new_len > 0x20000000)
-                        goto out_sem;
-                if (new_addr + new_len > TASK_SIZE - PAGE_SIZE)
-                        goto out_sem;
-        } else if ((ARCH_SUN4C_SUN4 && addr < 0xe0000000 &&
-                    addr + new_len > 0x20000000) ||
-                   addr + new_len > TASK_SIZE - PAGE_SIZE) {
-                unsigned long map_flags = 0;
-                struct file *file = NULL;
-
-                ret = -ENOMEM;
-                if (!(flags & MREMAP_MAYMOVE))
-                        goto out_sem;
-
-                vma = find_vma(current->mm, addr);
-                if (vma) {
-                        if (vma->vm_flags & VM_SHARED)
-                                map_flags |= MAP_SHARED;
-                        file = vma->vm_file;
-                }
-
-                new_addr = get_unmapped_area(file, addr, new_len,
-                                     vma ? vma->vm_pgoff : 0,
-                                     map_flags);
-                ret = new_addr;
-                if (new_addr & ~PAGE_MASK)
-                        goto out_sem;
-                flags |= MREMAP_FIXED;
-        }
         ret = do_mremap(addr, old_len, new_len, flags, new_addr);
-out_sem:
         up_write(&current->mm->mmap_sem);
 out:
         return ret;       

arch/sparc64/kernel/sys_sparc.c

@@ -542 +542 @@
         return ret;
 }
 
-int sparc64_mmap_check(unsigned long addr, unsigned long len,
-                unsigned long flags)
+int sparc64_mmap_check(unsigned long addr, unsigned long len)
 {
         if (test_thread_flag(TIF_32BIT)) {
                 if (len >= STACK_TOP32)
@@ -609 +608 @@
         unsigned long old_len, unsigned long new_len,
         unsigned long flags, unsigned long new_addr)
 {
-        struct vm_area_struct *vma;
         unsigned long ret = -EINVAL;
 
         if (test_thread_flag(TIF_32BIT))
                 goto out;
         if (unlikely(new_len >= VA_EXCLUDE_START))
                 goto out;
-        if (unlikely(invalid_64bit_range(addr, old_len)))
+        if (unlikely(sparc64_mmap_check(addr, old_len)))
+                goto out;
+        if (unlikely(sparc64_mmap_check(new_addr, new_len)))
                 goto out;
 
         down_write(&current->mm->mmap_sem);
-        if (flags & MREMAP_FIXED) {
-                if (invalid_64bit_range(new_addr, new_len))
-                        goto out_sem;
-        } else if (invalid_64bit_range(addr, new_len)) {
-                unsigned long map_flags = 0;
-                struct file *file = NULL;
-
-                ret = -ENOMEM;
-                if (!(flags & MREMAP_MAYMOVE))
-                        goto out_sem;
-
-                vma = find_vma(current->mm, addr);
-                if (vma) {
-                        if (vma->vm_flags & VM_SHARED)
-                                map_flags |= MAP_SHARED;
-                        file = vma->vm_file;
-                }
-
-                /* MREMAP_FIXED checked above. */
-                new_addr = get_unmapped_area(file, addr, new_len,
-                                    vma ? vma->vm_pgoff : 0,
-                                    map_flags);
-                ret = new_addr;
-                if (new_addr & ~PAGE_MASK)
-                        goto out_sem;
-                flags |= MREMAP_FIXED;
-        }
         ret = do_mremap(addr, old_len, new_len, flags, new_addr);
-out_sem:
         up_write(&current->mm->mmap_sem);
 out:
         return ret;       

arch/sparc64/kernel/sys_sparc32.c

@@ -867 +867 @@
         unsigned long old_len, unsigned long new_len,
         unsigned long flags, u32 __new_addr)
 {
-        struct vm_area_struct *vma;
         unsigned long ret = -EINVAL;
         unsigned long new_addr = __new_addr;
 
-        if (old_len > STACK_TOP32 || new_len > STACK_TOP32)
+        if (unlikely(sparc64_mmap_check(addr, old_len)))
                 goto out;
-        if (addr > STACK_TOP32 - old_len)
+        if (unlikely(sparc64_mmap_check(new_addr, new_len)))
                 goto out;
         down_write(&current->mm->mmap_sem);
-        if (flags & MREMAP_FIXED) {
-                if (new_addr > STACK_TOP32 - new_len)
-                        goto out_sem;
-        } else if (addr > STACK_TOP32 - new_len) {
-                unsigned long map_flags = 0;
-                struct file *file = NULL;
-
-                ret = -ENOMEM;
-                if (!(flags & MREMAP_MAYMOVE))
-                        goto out_sem;
-
-                vma = find_vma(current->mm, addr);
-                if (vma) {
-                        if (vma->vm_flags & VM_SHARED)
-                                map_flags |= MAP_SHARED;
-                        file = vma->vm_file;
-                }
-
-                /* MREMAP_FIXED checked above. */
-                new_addr = get_unmapped_area(file, addr, new_len,
-                                    vma ? vma->vm_pgoff : 0,
-                                    map_flags);
-                ret = new_addr;
-                if (new_addr & ~PAGE_MASK)
-                        goto out_sem;
-                flags |= MREMAP_FIXED;
-        }
         ret = do_mremap(addr, old_len, new_len, flags, new_addr);
-out_sem:
         up_write(&current->mm->mmap_sem);
 out:
         return ret;       

include/asm-sparc/mman.h

@@ -24 +24 @@
 
 #ifdef __KERNEL__
 #ifndef __ASSEMBLY__
-#define arch_mmap_check sparc_mmap_check
-int sparc_mmap_check(unsigned long addr, unsigned long len,
-                unsigned long flags);
+#define arch_mmap_check(addr,len,flags) sparc_mmap_check(addr,len)
+int sparc_mmap_check(unsigned long addr, unsigned long len);
 #endif
 #endif
 

include/asm-sparc64/mman.h

@@ -24 +24 @@
 
 #ifdef __KERNEL__
 #ifndef __ASSEMBLY__
-#define arch_mmap_check sparc64_mmap_check
-int sparc64_mmap_check(unsigned long addr, unsigned long len,
-                unsigned long flags);
+#define arch_mmap_check(addr,len,flags) sparc64_mmap_check(addr,len)
+int sparc64_mmap_check(unsigned long addr, unsigned long len);
 #endif
 #endif
 

arch/sparc/kernel/sys_sparc.c

@@ -223 +223 @@
 {
         if (ARCH_SUN4C_SUN4 &&
             (len > 0x20000000 ||
-             ((flags & MAP_FIXED) &&
-              addr < 0xe0000000 && addr + len > 0x20000000)))
+             (addr < 0xe0000000 && addr + len > 0x20000000)))
                 return -EINVAL;
 
         /* See asm-sparc/uaccess.h */

arch/sparc64/kernel/sys_sparc.c

@@ -549 +549 @@
                 if (len >= STACK_TOP32)
                         return -EINVAL;
 
-                if ((flags & MAP_FIXED) && addr > STACK_TOP32 - len)
+                if (addr > STACK_TOP32 - len)
                         return -EINVAL;
         } else {
                 if (len >= VA_EXCLUDE_START)
                         return -EINVAL;
 
-                if ((flags & MAP_FIXED) && invalid_64bit_range(addr, len))
+                if (invalid_64bit_range(addr, len))
                         return -EINVAL;
         }
 

fs/utimes.c

@@ -40 +40 @@
 
 #endif
 
+static bool nsec_special(long nsec)
+{
+        return nsec == UTIME_OMIT || nsec == UTIME_NOW;
+}
+
 static bool nsec_valid(long nsec)
 {
-        if (nsec == UTIME_OMIT || nsec == UTIME_NOW)
+        if (nsec_special(nsec))
                 return true;
 
         return nsec >= 0 && nsec <= 999999999;
@@ -119 +124 @@
                         newattrs.ia_mtime.tv_nsec = times[1].tv_nsec;
                         newattrs.ia_valid |= ATTR_MTIME_SET;
                 }
-        } else {
+        }
+
+        /*
+         * If times is NULL or both times are either UTIME_OMIT or
+         * UTIME_NOW, then need to check permissions, because
+         * inode_change_ok() won't do it.
+         */
+        if (!times || (nsec_special(times[0].tv_nsec) &&
+                       nsec_special(times[1].tv_nsec))) {
                 error = -EACCES;
                 if (IS_IMMUTABLE(inode))
                         goto mnt_drop_write_and_out;