Download/kernel/2.6.8/022stab078.14/changes

Changes

• Mainstream security updates (CVE-2006-1523, CVE-2006-3626)
• Drivers updates
• Other fixes

Patches

diff-scsi-megaraid-dma64-2006062

Patch from Vasily:

this patch prevent enable of 64-bit DMA on the Megaraid SATA 150-4 controller because of it does not support 64-bit DMA.

Bug #52530.

diff-ms-CVE-2006-3626

Patch prepared by Vasily, based on Linux mainstream patches.

Linux Kernel "proc/base.c" Userspace Interaction Local Privilege Escalation Vulnerability:

A vulnerability has been identified in Linux Kernel, which could be exploited by local attackers to obtain elevated privileges. This flaw is due to a race condition in the "pid_revalidate()" and "tid_fd_revalidate()" [fs/proc/base.c] functions, which could be exploited by malicious users to execute arbitrary commands with "root" privileges.

Fixed in 2.6.17.5 and and 2.6.17.6 mainstream kernels.

Bug #65414.

diff-ms-group-complete-signal

Patch from mainstream:
[PATCH] __group_complete_signal: remove bogus BUG_ON

[PATCH] RCU signal handling
made this BUG_ON() unsafe. This code runs under ->siglock, while switch_exec_pids() takes tasklist_lock.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

X-Git-URL: http://kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.16.y.git;a=commitdiff;h=0945e1a305ef6128c0405f1c5c8b5368d8756224
CVE-2006-1523
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188604
http://marc.theaimsgroup.com/?l=linux-kernel&m=114476543426600&w=2

Bug #64343.

diff-ms-ext3-bitmap-20060628

Patch from Vasily Averin:
found by Andrey Savochkin using tescase created by Dmitry Monakhov:
fixed ext3 block bitmap leakage, cause of following fsck messages: Block bitmap differences: -64159 -73707

Bug #64460.

linux-2.6.18-sky2-1.4.patch, diff-drv-sky2-backport-20060714

Patch prepared by Kostja:
sky driver updated up to 1.4 version.
Many bugs fixed, in particular interface unavailability after "transmit interrupt missed" error.

Sources were taken from mainstream 2.6.18-rc1-git8.

Obsoletes linux-2.6.8.1-sky2-0.13.patch.

Bug #60787.

linux-2.6.8.1-drbd-0.7.19-0.7.20.patch

Patch prepared by Kostja:
drbd driver updated up to 0.7.20 version.
Sources were taken from http://oss.linbit.com/drbd/.
Incremental from linux-2.6.8.1-drbd-0.7.19.patch.

Bug #57086.

diff-ms-exit-signal-fix-20060629

Patch from Pavel:
fixed issue triggered by 'RCU signal handling' exploit:
"Fix of signal_struct->curr_target value after __exit_signal(). When task calls __exit_signal() it moves curr_target pointer on the next thread. If task isn't changed - this pointer must be set to NULL. Otherwise race:

sys_execve()                                        sys_kill()
...                                                 ...
de_thread()
switch_exec_pids()
/* at this point thread and leader
* have shared signal_struct but splitted
* (empty) pids lists
*/
release_task()
sig->curr_target = next_thread(tsk);
/* at this point curr_target is set to
* tsk since it's PID_TYPE_TGID list is
* empty
*/
...
                                        ___group_complete_signal()
                                        `- t = p->signal->curr_target
                                        /* t is the task which tries to
                                         * exit on the 1st cpu so its
                                         * memory may already be freed
                                         */"

Bug #65473.
Bug #64343.
Bug #64479.

diff-ms-dethread-wait-race-20060712

Patch from mainstream, prepared by Pavel:
fixed issue trigered by 'RCU signal handling' exploit:
[PATCH] fix do_wait() vs exec() race

When non-leader thread does exec, de_thread adds old leader to the init's ->children list in EXIT_ZOMBIE state and drops tasklist_lock.

This means that release_task(leader) in de_thread() is racy vs do_wait() from init task.

I think de_thread() should set old leader's state to EXIT_DEAD instead.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: george anzinger <george@mvista.com>
Cc: Roland Dreier <rolandd@cisco.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Bug #64343.
Bug #64684.
Bug #65473.