++            Hot Fix 32.6 for Linux Kernel 2.4.32 - 2006/05/26            ++
              Willy Tarreau - EXOSEC  < wtarreau at exosec.net >


Please read the "README" file first. Then, simply run "make" in the directory
containing this file to rebuild the patches referenced in this file.


1) Security fixes
=================
+ 2.4.32-backport-of-CVE-2005-2709-fix-1                      (dann frazier)

  I've backported the fix for CVE-2005-2709 to 2.4 for Debian's 2.4 sarge
  kernel. sysctl.c in Linux kernel before 2.6.14.1 allows local users to
  cause a denial of service (kernel oops) and possibly execute code by
  opening an interface file in /proc/sys/net/ipv4/conf/, waiting until the
  interface is unregistered, then obtaining and modifying function pointers
  in memory that was used for the ctl_table.

+ 2.4.32-ipv6-fix-refcnt-of-struct-ip6_flowlabel-1               (Yan Zheng)

  This looks like another potential "local DoS" since this is in
  setsockopt(IPV6_FLOWLABEL_MGR). Users can cause a flow label to be
  kfreed() without removing it from the socket; and then overwrite its
  contents. This can trigger random kernel memory corruption.

+ 2.4.32-fix-sendmsg-overflow-CVE-2005-2490-1              (Marcus Meissner)

  Al Viro reported a flaw in sendmsg(). "When we copy 32bit ->msg_control
  contents to kernel, we walk the same userland data twice without sanity
  checks on the second pass. Moreover, if original looks small enough, we
  end up copying to on-stack array." - CVE-2005-2490.

+ 2.4.32-vfs-local-denial-of-service-file-lease-1                    (Horms)

  [PATCH] VFS: local denial-of-service with file leases (CVE-2005-3857)
  Remove time_out_leases() printk that's easily triggered by users.

+ 2.4.32-x86-64-user-code-panics-kernel-CVE-2005-2708-1      (Dave Anderson)

  There seems to be a local DoS in exec on AMD64 / linux 2.4 when the
  system is under memory pressure.
  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=161925

+ 2.4.32-IGMP-workaround-for-IGMP-v1-v2-bug-1                (David Stevens)

  As explained at http://www.cs.ucsb.edu/~krishna/igmp_dos/
  With IGMP version 1 and 2 it is possible to inject a unicast report to
  a client which will make it ignore multicast reports sent later by the
  router. The fix is to only accept the report if is was sent to a
  multicast or unicast address.

+ 2.4.32-ipv6-mcast-igmp-dos-fix-1                         (David S. Miller)

  Same issue as IPv4, don't listen to non-broadcast non-multicast reports.

+ 2.4.32-wan-sdla-fix-probable-security-hole-1                       (Horms)

  [PATCH] wan sdla:  fix probable security hole
  Quoting Chris Wright : "Hrm, I believe you could use this to read 128k
  of kernel memory. sdla_read() takes len as a short, whereas mem.len is
  an int. So, if mem.len == 0x20000, the allocation could still succeed.
  When cast to short, len will be 0x0, causing the read loop to copy
  nothing into the buffer. At least it's protected by a capable() check.
  I don't know what proper upper bound is for this hardware, or how much
  it's used/cared about. Simple memset() is trivial fix."
  This seems to be applicable to 2.4.

+ 2.4.32-CAN-2004-1058-proc_pid_cmdline-race-fix-1            (dann frazier)

  The following patch fixes a race condition that allows local users to
  view the environment variables of another process. Taken from Red Hat's
  kernel-2.4.21-27.0.4.EL.src.rpm.

+ 2.4.32-orinoco-cve-2005-3180-information-leakage-1                 (horms)

  Fix for CVE-2005-3180 by Alan Cox, back-ported by Horms. Fixes
  and etherleak bug in the orinoco driver. As yet untested.

+ 2.4.32-x86_64-check-for-bad-elf-entry-address-1               (andi kleen)

  Fixes a local DOS on Intel systems that lead to an endless recursive
  fault. AMD machines don't seem to be affected. Actually based on a
  2.6 patch by Suresh Siddha, but the 2.4 implementation is somewhat
  different.

+ 2.4.32-information-leak-in-SO_ORIGINAL_DST-and-getname-1 (pavel kankovsky)

  It appears sockaddr_in.sin_zero is not zeroed during certain operations
  returning IPv4 socket names : getsockopt(...SO_ORIGINAL_DST...),
  getsockname() and getpeername().

+ 2.4.32-CVE-2006-0741-always-check-that-rips-are-canonical-1   (Andi Kleen)

  This works around a problem in handling non canonical RIPs on SYSRET on
  Intel CPUs. They report the #GP on the SYSRET, not the next instruction
  as Linux expects it. With these changes this path should never see a non
  canonical user RIP. This is CVE-2006-0741. Roughly based on a patch by
  Ernie Petrides, but redone by AK.

+ 2.4.32-CVE-2006-1524-fix-shm-mprotect-1                     (Hugh Dickins)

  shmat stop mprotect from giving write permission to a readonly
  attachment.

+ 2.4.32-CVE-2006-1056-i386-x86_64-x87-information-leak-1       (Andi Kleen)

  AMD K7/K8 CPUs only save/restore the FOP/FIP/FDP x87 registers in FXSAVE
  when an exception is pending. This means the value leak through context
  switches and allow processes to observe some x87 instruction state of
  other processes. This is CVE-2006-1056. The problem was discovered
  originally by Jan Beulich. Richard Brunner provided the basic code for
  the workarounds with contributions from Jan.

+ 2.4.32-via-rhine-zero-pad-short-packets-1                    (Craig Brind)

  Fixes Rhine I cards disclosing fragments of previously transmitted
  frames in new transmissions.

  Before transmission, any socket buffer (skb) shorter than the ethernet
  minimum length of 60 bytes was zero-padded. On Rhine I cards the data
  can later be copied into an aligned transmission buffer without copying
  this padding. This resulted in the transmission of the frame with the
  extra bytes beyond the provided content leaking the previous contents of
  this buffer on to the network. Now zero-padding is repeated in the local
  aligned buffer if one is used.

+ 2.4.32-CVE-2006-1864-smbfs-escape-chroot-1                    (Olaf Kirch)

  Initial work and description from Olaf Kirch for kernel 2.6 :
  Mark Moseley reported that a chroot environment on a SMB share can be
  left via "cd ..\".  Similar to CVE-2006-1863 issue with cifs, this fix
  is for smbfs (CVE-2006-1864). Steven French <sfrench@us.ibm.com> wrote:
  Looks fine to me.  This should catch the slash on lookup or equivalent,
  which will be all obvious paths of interest. Back-ported from 2.6 to 2.4
  by Willy Tarreau.

+ 2.4.32-CVE-2006-2444-netfilter-snmp-nat-mem-corruption-1 (Patrick McHardy)

  CVE-2006-2444 - Potential remote DoS in SNMP NAT helper.
  Fix memory corruption caused by snmp_trap_decode which may free
  random memory when snmp_trap_decode fails. The corruption can be
  triggered remotely when the ip_nat_snmp_basic module is loaded
  and traffic on port 161 or 162 is NATed.

2) Critical fixes
=================
- None

+ 2.4.32-e1000-do-not-call-msec_delay-in-irq-context-1    (jesse brandeburg)

  There are some functions that are called in irq context that need to use
  msec_delay_irq instead to avoid a BUG.

3) Major bug fixes
==================
+ 2.4.32-airo_cs-prototypes-1                                  (Adrian Bunk)

  If you got strange problems with either airo_cs devices or in any other
  completely unrelated part of the kernel shortly or long after a airo_cs
  device was detected by the kernel, this might have been caused by the
  fact that caller and callee disagreed regarding the size of the first
  argument to init_airo_card()...

+ 2.4.32-dont-panic-on-ide-dma-errors-1                         (Chris Ross)

  Kernel 2.4.32 and earlier can panic when trying to read a corrupted
  sector from an IDE disk. The function ide_dma_timeout_retry can end
  a request early by calling idedisk_error, but then goes on to use the
  request anyway causing a kernel panic due to a null pointer exception.

+ 2.4.32-data-corruption-in-smb_proc_setattr_unix-1      (Maciej W. Rozycki)

  This patch fixes a data corruption in smb_proc_setattr_unix().
  smb_filetype_from_mode() returns an u32, and there are only four bytes
  reserved for it in data.

+ 2.4.32-bond_alb-hash-table-corruption-1                (ODonnell, Michael)

  Our systems have been crashing during testing of PCI HotPlug
  support in the various networking components. We've faulted in
  the bonding driver due to a bug in bond_alb.c:tlb_clear_slave().
  In that routine, the last modification to the TLB hash table is
  made without protection of the lock, allowing a race that can
  lead tlb_choose_channel() to select an invalid table element.

+ 2.4.32-fix-overflow-in-inode-1                              (Rik van Riel)

  The following patch fixes an overflow in inode.c. This overflow can cause
  a system to stop reclaiming inodes, with a large amount of memory and
  zillions of inodes. This has caused systems to run out of low memory in
  real world situations. Thanks go out to Larry Woodman, as well as the
  unnamed customer who first tracked this problem down.

+ 2.4.32-netfilter-ipt_recent-memleak-1                        (Jesper Juhl)

  The Coverity checker spotted that we may leak 'hold' in 
  net/ipv4/netfilter/ipt_recent.c::checkentry() when the following
  is true : 
    if (!curr_table->status_proc) {
      ...
      if(!curr_table) {
      ...
        return 0;  <-- here we leak.
  Simply moving an existing vfree(hold); up a bit avoids the possible leak.

+ 2.4.32-memleak-on-corrupted-ext3-journal-1                 (Theodore Ts'o)

  Fix memory leak when the ext3's journal file is corrupted

+ 2.4.32-avoid-panic-on-corrupted-ext3-journal-1             (Willy Tarreau)

  Backport from 2.6 of a patch from Andrew Morton : Don't panic if the
  journal superblock is wrecked: just fail the mount.

4) Minor bug fixes
==================
+ 2.4.32-rc2-mcast-filter-1                                  (Willy Tarreau)

  [PATCH-2.4][MCAST]IPv6: small fix for ip6_mc_msfilter(...)
  Multicast source filters aren't widely used yet, and that's really
  the only feature that's affected if an application actually exercises
  this bug, as far as I can tell. An ordinary filter-less multicast join
  should still work, and only forwarded multicast traffic making use of
  filters and doing empty-source filters with the MSFILTER ioctl would
  be at risk of not getting multicast traffic forwarded to them because
  the reports generated would not be based on the correct counts.
  Initial 2.6 patch by Yan Zheng, bug explanation by David Stevens,
  patch ACKed by David.

+ 2.4.32-fix-for-clock-running-too-fast-1                  (Akira Tsukamoto)

  This one line patch adds upper bound testing inside timer_irq_works()
  when evaluating whether irq timer works or not on boot up. It fix the
  machines having problem with clock running too fast. What this patch
  do is, if timer interrupts running too fast through IO-APIC IRQ then
  false back to i8259A IRQ.

+ 2.4.32-fix-ptrace-self-attach-rule-1                      (Linus Torvalds)

  [PATCH] Fix ptrace self-attach rule
  Before we did CLONE_THREAD, the way to check whether we were attaching
  to ourselves was to just check "current == task", but with CLONE_THREAD
  we should check that the thread group ID matches instead.

+ 2.4.32-dcache-avoid-race-nr_unused-dentries-1                 (Neil Brown)

  [PATCH] fs/dcache.c: avoid race when updating nr_unused count of unused
  dentries. d_count==1 is no guarantee that dentry is on the dentry_unused
  list, even if it has just been incremented inside dcache_lock, as dput
  can decrement at any time. This test from Greg Banks is much safer, and
  is more transparently correct.

+ 2.4.32-make-kernel-work-on-i486-again-1                  (jacek lipkowski)

  Booting the 2.4.32 kernel compiled for a i486 on an i486 box fails,
  because "Kernel compiled for Pentium+, requires TSC feature!" (printed
  from check_config() include/asm-i386/bugs.h).

+ 2.4.32-ppc64-fix-sys_rt_sigreturn-return-type-1         (stephen rothwell)

  Paul Mackerras noticed that sys_rt_sigreturn's return value was "int".
  It needs to be "long" or else the return value of a syscall that is
  interrupted by a signal will be truncated to 32 bits and then sign
  extended. This causes .e.g mmap's return value to be corrupted if it
  is returning an address above 2^31 (which is what caused a SEGV in
  malloc). This problem obviously only affects 64 bit processes.

+ 2.4.32-ip_queue-fix-wrong-skb-len-nlmsg_len-assumption-1     (thomas graf)

  The size of the skb carrying the netlink message is not equivalent to the
  length of the actual netlink message due to padding. ip_queue matches the
  length of the payload against the original packet size to determine if
  packet mangling is desired, due to the above wrong assumption arbitary
  packets may not be mangled depening on their original size.

+ 2.4.32-drm_stub_open-range-checking-1                        (marin mitov)

  Xorg-6.9.0 SIGSEGFAULTs when the loading of dri module is enabled (direct
  rendering). Xorg-6.9.0 (and evidently not the previous versions) has
  defined DRM_MAX_MINOR as 255 (and Xorg-6.9.0 tries to open all of them)
  while in the kernel:  DRM_STUB_MAXCARDS is defined as 16.

+ 2.4.32-nfs-cache-consistency-with-mmap-1                     (Jeff Layton)

  A customer of Red Hat reported a problem with cache invalidation when
  using mmapped files over NFS with the 2.4 kernel. This patch fixes this
  by checking whether the clean_pages list for the inode is empty after
  invalidate_inode_pages is called. If it's not then we set a flag so on
  the next pass through it automatically flags the data as invalid.

+ 2.4.32-vlan_ioctl-missing-checks-1                         (Mika Kukkonen)

  In vlan_ioctl_handler() the code misses couple checks for
  error return values. The same patch was merged into 2.6.

+ 2.4.32-quota_v2-module-taints-the-kernel-1                   (Marek Szuba)

  Apparently the quota_v2 module in 2.4 still lacks the licence macro
  and taints the kernel, even though the same module in 2.6 is correctly
  tagged as GPL. In case it makes things any easier, I am enclosing an
  appropriate patch.

+ 2.4.32-fix-usb-fdd-without-partitions-1                 (Gilles Espinasse)

  When an USB flash disk is formatted as a floppy (without partitions),
  random partitions appear in /proc/partitions depending on the code and
  data used by the boot loader at the offset where the partition table
  is expected. Such layout appears when Windows is used to format the USB
  stick, or when putting a boot-loader such as syslinux on an device. This
  patch is a back-port of the 2.6 fix. Carefully tested, works as expected.

+ 2.4.32-expire-stale-arp-entries-1                        (Pradeep Vincent)

  In 2.4.21, arp code uses gc_timer to check for stale arp cache
  entries. In 2.6, each entry has its own timer to check for stale arp
  cache. 2.4.29 to 2.4.32 kernels (atleast) use neither of these timers.
  This causes problems in environments where IPs or MACs are reassigned
  - saw this problem on load balancing router based networks that use
  VMACs. Tested this code on load balancing router based networks as
  well as peer-linux systems.

+ 2.4.32-ext2-update-inode-ctime-on-rename-1                 (Willy TARREAU)

  The ext2fs filesystem on 2.2 and 2.6, as well as other filesystems
  on 2.4 update the inode ctime on rename(). When this fix was applied
  to 2.2.13, it was applied to the ext3 tree at the same time, but the
  ext2 tree was forgotten. It was recently fixed in 2.6, but 2.4 was
  forgotten again. First reported by Chris Siebenmann on 10 Jan 2004.


5) Build fixes
==============
- None

+ 2.4.32-sparc-fix-compile-failures-in-math-emu-1             (david miller)

  Kill debugging default switch cases in do_one_mathemu(). That case is
  handled properly already and gcc hates the empty statement that results
  when the debug code is disabled. Pointed out by kaffe.

+ 2.4.32-alpha-fix-recursive-inlining-failure-pci_iommu-1   (solar designer)

  Building on alpha with gcc 3.4.5 fails because of recursive inlining.
  Simply removing the "inline" from the declaration of sg_fill() makes
  it build and work.

+ 2.4.32-build-fix-auto_fs4-changes-broke-ppc64-build-1   (jesse brandeburg)

  This patch adds a couple of #include statements verified to fix the
  compile for ppc64 and probably will fix the compile on parisc. ppc64
  would not build without this fix.

+ 2.4.32-ver_linux-binutils-version-reporting-1                (Joshua Kwan)

  The 'ver_linux' script expects 'ld' to output a line starting with
  'BFD', while recent versions of 'ld' print 'GNU ld'. The effect is
  that binutils version is not listed in reports based on ver_linux.

6) Documentation fixes
======================
- None

END.