rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch (CVE-2010-2954)

This commit is contained in:
Chuck Ebbert 2010-09-03 08:10:14 -04:00
parent 7898ca3d1b
commit 9f10c3d7e5
2 changed files with 41 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch Normal file
View File

@ -0,0 +1,35 @@
From: David S. Miller <davem@davemloft.net>
Date: Tue, 31 Aug 2010 01:35:24 +0000 (-0700)
Subject: irda: Correctly clean up self->ias_obj on irda_bind() failure.
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fdavem%2Fnet-2.6.git;a=commitdiff_plain;h=628e300cccaa628d8fb92aa28cb7530a3d5f2257
irda: Correctly clean up self->ias_obj on irda_bind() failure.
If irda_open_tsap() fails, the irda_bind() code tries to destroy
the ->ias_obj object by hand, but does so wrongly.
In particular, it fails to a) release the hashbin attached to the
object and b) reset the self->ias_obj pointer to NULL.
Fix both problems by using irias_delete_object() and explicitly
setting self->ias_obj to NULL, just as irda_release() does.
Reported-by: Tavis Ormandy <taviso@cmpxchg8b.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 79986a6..fd55b51 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -824,8 +824,8 @@ static int irda_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
err = irda_open_tsap(self, addr->sir_lsap_sel, addr->sir_name);
if (err < 0) {
- kfree(self->ias_obj->name);
- kfree(self->ias_obj);
+ irias_delete_object(self->ias_obj);
+ self->ias_obj = NULL;
goto out;
}

6
kernel.spec
View File

@ -766,7 +766,9 @@ Patch12460: xfs-move-aio-completion-after-unwritten-extent-conversion.patch
Patch12470: drivers-hwmon-coretemp-c-detect-the-thermal-sensors-by-cpuid.patch
Patch12480: kprobes-x86-fix-kprobes-to-skip-prefixes-correctly.patch
Patch12490: dell-wmi-add-support-for-eject-key.patch
Patch12500: irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch
%endif
@ -1430,6 +1432,9 @@ ApplyPatch kprobes-x86-fix-kprobes-to-skip-prefixes-correctly.patch
# bz #513530
ApplyPatch dell-wmi-add-support-for-eject-key.patch
# cve-2010-2954
ApplyPatch irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch
# END OF PATCH APPLICATIONS
%endif
@ -2054,6 +2059,7 @@ fi
* Fri Sep 03 2010 Chuck Ebbert <cebbert@redhat.com> 2.6.34.6-50
- Re-enable I2O, but only for 32-bit x86 (#629676)
- Add support for eject key on Dell laptops (#513530)
- irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch (CVE-2010-2954)
* Thu Sep 02 2010 Dave Airlie <airlied@redhat.com> 2.6.34.6-49
- fix radeon suspend/resume issues and two other minor patches