From 9f10c3d7e5783f8948b7f19c56bdaf20aeb4875d Mon Sep 17 00:00:00 2001 From: Chuck Ebbert Date: Sep 03 2010 12:10:14 +0000 Subject: irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch (CVE-2010-2954) --- diff --git a/irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch b/irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch new file mode 100644 index 0000000..7afc4df --- /dev/null +++ b/irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch @@ -0,0 +1,35 @@ +From: David S. Miller +Date: Tue, 31 Aug 2010 01:35:24 +0000 (-0700) +Subject: irda: Correctly clean up self->ias_obj on irda_bind() failure. +X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fdavem%2Fnet-2.6.git;a=commitdiff_plain;h=628e300cccaa628d8fb92aa28cb7530a3d5f2257 + +irda: Correctly clean up self->ias_obj on irda_bind() failure. + +If irda_open_tsap() fails, the irda_bind() code tries to destroy +the ->ias_obj object by hand, but does so wrongly. + +In particular, it fails to a) release the hashbin attached to the +object and b) reset the self->ias_obj pointer to NULL. + +Fix both problems by using irias_delete_object() and explicitly +setting self->ias_obj to NULL, just as irda_release() does. + +Reported-by: Tavis Ormandy +Signed-off-by: David S. Miller +--- + +diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c +index 79986a6..fd55b51 100644 +--- a/net/irda/af_irda.c ++++ b/net/irda/af_irda.c +@@ -824,8 +824,8 @@ static int irda_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + + err = irda_open_tsap(self, addr->sir_lsap_sel, addr->sir_name); + if (err < 0) { +- kfree(self->ias_obj->name); +- kfree(self->ias_obj); ++ irias_delete_object(self->ias_obj); ++ self->ias_obj = NULL; + goto out; + } + diff --git a/kernel.spec b/kernel.spec index 2c8de29..d9925f1 100644 --- a/kernel.spec +++ b/kernel.spec @@ -766,7 +766,9 @@ Patch12460: xfs-move-aio-completion-after-unwritten-extent-conversion.patch Patch12470: drivers-hwmon-coretemp-c-detect-the-thermal-sensors-by-cpuid.patch Patch12480: kprobes-x86-fix-kprobes-to-skip-prefixes-correctly.patch + Patch12490: dell-wmi-add-support-for-eject-key.patch +Patch12500: irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch %endif @@ -1430,6 +1432,9 @@ ApplyPatch kprobes-x86-fix-kprobes-to-skip-prefixes-correctly.patch # bz #513530 ApplyPatch dell-wmi-add-support-for-eject-key.patch +# cve-2010-2954 +ApplyPatch irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch + # END OF PATCH APPLICATIONS %endif @@ -2054,6 +2059,7 @@ fi * Fri Sep 03 2010 Chuck Ebbert 2.6.34.6-50 - Re-enable I2O, but only for 32-bit x86 (#629676) - Add support for eject key on Dell laptops (#513530) +- irda-correctly-clean-up-self-ias_obj-on-irda_bind-failure.patch (CVE-2010-2954) * Thu Sep 02 2010 Dave Airlie 2.6.34.6-49 - fix radeon suspend/resume issues and two other minor patches