[gentoo-commits] linux-patches r1345 - genpatches-2.6/trunk/2.6.25

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2008-10-06 11:16:31 +0000 (Mon, 06 Oct 2008)
New Revision: 1345

Added:
   genpatches-2.6/trunk/2.6.25/1016_linux-2.6.25.17.patch
   genpatches-2.6/trunk/2.6.25/1500_thinkpad_acpi-null-ptr-deref-fix.patch
   genpatches-2.6/trunk/2.6.25/1501_nfs-validate_mount_data-null-ptr-deref-fixes.patch
   genpatches-2.6/trunk/2.6.25/1502_wan-sbni_ioctl-add-missing-capability-checks.patch
Modified:
   genpatches-2.6/trunk/2.6.25/0000_README
Log:
Adding 2.6.25.17, and three security patches. A null pointer dereference in the thinkpad acpi, another one in nfs and missing capability checks.

Modified: genpatches-2.6/trunk/2.6.25/0000_README
===================================================================
--- genpatches-2.6/trunk/2.6.25/0000_README	2008-09-08 19:03:45 UTC (rev 1344)
+++ genpatches-2.6/trunk/2.6.25/0000_README	2008-10-06 11:16:31 UTC (rev 1345)
@@ -103,6 +103,22 @@
 From:	http://www.kernel.org
 Desc:	Linux 2.6.25.16
 
+Patch:	1016_linux-2.6.25.17.patch
+From:	http://www.kernel.org
+Desc:	Linux 2.6.25.17
+
+Patch:  1500_thinkpad_acpi-null-ptr-deref-fix.patch
+From:	http://bugs.gentoo.org/222331
+Desc:   Fixes potential NULL pointer deref in Thinkpad ACPI
+
+Patch:  1501_nfs-validate_mount_data-null-ptr-deref-fixes.patch
+From:	http://bugs.gentoo.org/222249
+Desc:   Fixes potential NULL pointer derefs in NFSv{3,4}
+
+Patch:  1502_wan-sbni_ioctl-add-missing-capability-checks.patch
+From:   http://www.kernel.org
+Desc:   Adds missing capability checks in drivers/net/wan/sbni.c -> sbni_ioctl()
+
 Patch:	2500_fix-missing-scsi-inlines.patch
 From:	http://bugs.gentoo.org/232747
 Desc:	Fix missing inlines in header file

Added: genpatches-2.6/trunk/2.6.25/1016_linux-2.6.25.17.patch
===================================================================
--- genpatches-2.6/trunk/2.6.25/1016_linux-2.6.25.17.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.25/1016_linux-2.6.25.17.patch	2008-10-06 11:16:31 UTC (rev 1345)
@@ -0,0 +1,706 @@
+diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
+index 3e18db4..f49c970 100644
+--- a/arch/x86/kernel/cpu/mtrr/generic.c
++++ b/arch/x86/kernel/cpu/mtrr/generic.c
+@@ -229,6 +229,7 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
+ 			     unsigned long *size, mtrr_type *type)
+ {
+ 	unsigned int mask_lo, mask_hi, base_lo, base_hi;
++	unsigned int tmp, hi;
+ 
+ 	rdmsr(MTRRphysMask_MSR(reg), mask_lo, mask_hi);
+ 	if ((mask_lo & 0x800) == 0) {
+@@ -242,8 +243,18 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
+ 	rdmsr(MTRRphysBase_MSR(reg), base_lo, base_hi);
+ 
+ 	/* Work out the shifted address mask. */
+-	mask_lo = size_or_mask | mask_hi << (32 - PAGE_SHIFT)
+-	    | mask_lo >> PAGE_SHIFT;
++	tmp = mask_hi << (32 - PAGE_SHIFT) | mask_lo >> PAGE_SHIFT;
++	mask_lo = size_or_mask | tmp;
++	/* Expand tmp with high bits to all 1s*/
++	hi = fls(tmp);
++	if (hi > 0) {
++		tmp |= ~((1<<(hi - 1)) - 1);
++
++		if (tmp != mask_lo) {
++			WARN_ON("mtrr: your BIOS has set up an incorrect mask, fixing it up.\n");
++			mask_lo = tmp;
++		}
++	}
+ 
+ 	/* This works correctly if size is a power of two, i.e. a
+ 	   contiguous range. */
+diff --git a/crypto/authenc.c b/crypto/authenc.c
+index 4b22676..fd9f06c 100644
+--- a/crypto/authenc.c
++++ b/crypto/authenc.c
+@@ -174,8 +174,9 @@ static int crypto_authenc_genicv(struct aead_request *req, u8 *iv,
+ static void crypto_authenc_encrypt_done(struct crypto_async_request *req,
+ 					int err)
+ {
++	struct aead_request *areq = req->data;
++
+ 	if (!err) {
+-		struct aead_request *areq = req->data;
+ 		struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
+ 		struct crypto_authenc_ctx *ctx = crypto_aead_ctx(authenc);
+ 		struct ablkcipher_request *abreq = aead_request_ctx(areq);
+@@ -185,7 +186,7 @@ static void crypto_authenc_encrypt_done(struct crypto_async_request *req,
+ 		err = crypto_authenc_genicv(areq, iv, 0);
+ 	}
+ 
+-	aead_request_complete(req->data, err);
++	aead_request_complete(areq, err);
+ }
+ 
+ static int crypto_authenc_encrypt(struct aead_request *req)
+@@ -216,14 +217,15 @@ static int crypto_authenc_encrypt(struct aead_request *req)
+ static void crypto_authenc_givencrypt_done(struct crypto_async_request *req,
+ 					   int err)
+ {
++	struct aead_request *areq = req->data;
++
+ 	if (!err) {
+-		struct aead_request *areq = req->data;
+ 		struct skcipher_givcrypt_request *greq = aead_request_ctx(areq);
+ 
+ 		err = crypto_authenc_genicv(areq, greq->giv, 0);
+ 	}
+ 
+-	aead_request_complete(req->data, err);
++	aead_request_complete(areq, err);
+ }
+ 
+ static int crypto_authenc_givencrypt(struct aead_givcrypt_request *req)
+diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
+index 8e877e7..5435970 100644
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -5249,7 +5249,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
+ 	if (id->driver_data & DEV_HAS_CHECKSUM) {
+ 		np->rx_csum = 1;
+ 		np->txrxctl_bits |= NVREG_TXRXCTL_RXCHECK;
+-		dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
++		dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
+ 		dev->features |= NETIF_F_TSO;
+ 	}
+ 
+@@ -5548,7 +5548,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
+ 
+ 	dev_printk(KERN_INFO, &pci_dev->dev, "%s%s%s%s%s%s%s%s%s%sdesc-v%u\n",
+ 		   dev->features & NETIF_F_HIGHDMA ? "highdma " : "",
+-		   dev->features & (NETIF_F_HW_CSUM | NETIF_F_SG) ?
++		   dev->features & (NETIF_F_IP_CSUM | NETIF_F_SG) ?
+ 		   	"csum " : "",
+ 		   dev->features & (NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX) ?
+ 		   	"vlan " : "",
+diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
+index 42d7c0a..0e4eb15 100644
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -2822,7 +2822,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
+ 					pkt_size, PCI_DMA_FROMDEVICE);
+ 				rtl8169_mark_to_asic(desc, tp->rx_buf_sz);
+ 			} else {
+-				pci_unmap_single(pdev, addr, pkt_size,
++				pci_unmap_single(pdev, addr, tp->rx_buf_sz,
+ 						 PCI_DMA_FROMDEVICE);
+ 				tp->Rx_skbuff[entry] = NULL;
+ 			}
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index d8160fa..9c2b7b4 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -531,8 +531,8 @@ static int acm_tty_open(struct tty_struct *tty, struct file *filp)
+ 	tasklet_schedule(&acm->urb_task);
+ 
+ done:
+-err_out:
+ 	mutex_unlock(&acm->mutex);
++err_out:
+ 	mutex_unlock(&open_mutex);
+ 	return rv;
+ 
+diff --git a/drivers/video/fb_defio.c b/drivers/video/fb_defio.c
+index 59df132..4835bdc 100644
+--- a/drivers/video/fb_defio.c
++++ b/drivers/video/fb_defio.c
+@@ -114,6 +114,17 @@ static struct vm_operations_struct fb_deferred_io_vm_ops = {
+ 	.page_mkwrite	= fb_deferred_io_mkwrite,
+ };
+ 
++static int fb_deferred_io_set_page_dirty(struct page *page)
++{
++	if (!PageDirty(page))
++		SetPageDirty(page);
++	return 0;
++}
++
++static const struct address_space_operations fb_deferred_io_aops = {
++	.set_page_dirty = fb_deferred_io_set_page_dirty,
++};
++
+ static int fb_deferred_io_mmap(struct fb_info *info, struct vm_area_struct *vma)
+ {
+ 	vma->vm_ops = &fb_deferred_io_vm_ops;
+@@ -163,6 +174,14 @@ void fb_deferred_io_init(struct fb_info *info)
+ }
+ EXPORT_SYMBOL_GPL(fb_deferred_io_init);
+ 
++void fb_deferred_io_open(struct fb_info *info,
++			 struct inode *inode,
++			 struct file *file)
++{
++	file->f_mapping->a_ops = &fb_deferred_io_aops;
++}
++EXPORT_SYMBOL_GPL(fb_deferred_io_open);
++
+ void fb_deferred_io_cleanup(struct fb_info *info)
+ {
+ 	void *screen_base = (void __force *) info->screen_base;
+diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
+index 01072f4..79b410c 100644
+--- a/drivers/video/fbmem.c
++++ b/drivers/video/fbmem.c
+@@ -1315,6 +1315,10 @@ fb_open(struct inode *inode, struct file *file)
+ 		if (res)
+ 			module_put(info->fbops->owner);
+ 	}
++#ifdef CONFIG_FB_DEFERRED_IO
++	if (info->fbdefio)
++		fb_deferred_io_open(info, inode, file);
++#endif
+ 	return res;
+ }
+ 
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 40b6900..a80a917 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -835,6 +835,10 @@ ssize_t cifs_user_write(struct file *file, const char __user *write_data,
+ 		return -EBADF;
+ 	open_file = (struct cifsFileInfo *) file->private_data;
+ 
++	rc = generic_write_checks(file, poffset, &write_size, 0);
++	if (rc)
++		return rc;
++
+ 	xid = GetXid();
+ 
+ 	if (*poffset > file->f_path.dentry->d_inode->i_size)
+diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
+index 350680f..b392002 100644
+--- a/fs/cramfs/inode.c
++++ b/fs/cramfs/inode.c
+@@ -44,58 +44,13 @@ static DEFINE_MUTEX(read_mutex);
+ static int cramfs_iget5_test(struct inode *inode, void *opaque)
+ {
+ 	struct cramfs_inode *cramfs_inode = opaque;
+-
+-	if (inode->i_ino != CRAMINO(cramfs_inode))
+-		return 0; /* does not match */
+-
+-	if (inode->i_ino != 1)
+-		return 1;
+-
+-	/* all empty directories, char, block, pipe, and sock, share inode #1 */
+-
+-	if ((inode->i_mode != cramfs_inode->mode) ||
+-	    (inode->i_gid != cramfs_inode->gid) ||
+-	    (inode->i_uid != cramfs_inode->uid))
+-		return 0; /* does not match */
+-
+-	if ((S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) &&
+-	    (inode->i_rdev != old_decode_dev(cramfs_inode->size)))
+-		return 0; /* does not match */
+-
+-	return 1; /* matches */
++	return inode->i_ino == CRAMINO(cramfs_inode) && inode->i_ino != 1;
+ }
+ 
+ static int cramfs_iget5_set(struct inode *inode, void *opaque)
+ {
+-	static struct timespec zerotime;
+ 	struct cramfs_inode *cramfs_inode = opaque;
+-	inode->i_mode = cramfs_inode->mode;
+-	inode->i_uid = cramfs_inode->uid;
+-	inode->i_size = cramfs_inode->size;
+-	inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1;
+-	inode->i_gid = cramfs_inode->gid;
+-	/* Struct copy intentional */
+-	inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime;
+ 	inode->i_ino = CRAMINO(cramfs_inode);
+-	/* inode->i_nlink is left 1 - arguably wrong for directories,
+-	   but it's the best we can do without reading the directory
+-           contents.  1 yields the right result in GNU find, even
+-	   without -noleaf option. */
+-	if (S_ISREG(inode->i_mode)) {
+-		inode->i_fop = &generic_ro_fops;
+-		inode->i_data.a_ops = &cramfs_aops;
+-	} else if (S_ISDIR(inode->i_mode)) {
+-		inode->i_op = &cramfs_dir_inode_operations;
+-		inode->i_fop = &cramfs_directory_operations;
+-	} else if (S_ISLNK(inode->i_mode)) {
+-		inode->i_op = &page_symlink_inode_operations;
+-		inode->i_data.a_ops = &cramfs_aops;
+-	} else {
+-		inode->i_size = 0;
+-		inode->i_blocks = 0;
+-		init_special_inode(inode, inode->i_mode,
+-			old_decode_dev(cramfs_inode->size));
+-	}
+ 	return 0;
+ }
+ 
+@@ -105,12 +60,48 @@ static struct inode *get_cramfs_inode(struct super_block *sb,
+ 	struct inode *inode = iget5_locked(sb, CRAMINO(cramfs_inode),
+ 					    cramfs_iget5_test, cramfs_iget5_set,
+ 					    cramfs_inode);
++	static struct timespec zerotime;
++
+ 	if (inode && (inode->i_state & I_NEW)) {
++		inode->i_mode = cramfs_inode->mode;
++		inode->i_uid = cramfs_inode->uid;
++		inode->i_size = cramfs_inode->size;
++		inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1;
++		inode->i_gid = cramfs_inode->gid;
++		/* Struct copy intentional */
++		inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime;
++		/* inode->i_nlink is left 1 - arguably wrong for directories,
++		   but it's the best we can do without reading the directory
++		   contents.  1 yields the right result in GNU find, even
++		   without -noleaf option. */
++		if (S_ISREG(inode->i_mode)) {
++			inode->i_fop = &generic_ro_fops;
++			inode->i_data.a_ops = &cramfs_aops;
++		} else if (S_ISDIR(inode->i_mode)) {
++			inode->i_op = &cramfs_dir_inode_operations;
++			inode->i_fop = &cramfs_directory_operations;
++		} else if (S_ISLNK(inode->i_mode)) {
++			inode->i_op = &page_symlink_inode_operations;
++			inode->i_data.a_ops = &cramfs_aops;
++		} else {
++			inode->i_size = 0;
++			inode->i_blocks = 0;
++			init_special_inode(inode, inode->i_mode,
++				old_decode_dev(cramfs_inode->size));
++		}
+ 		unlock_new_inode(inode);
+ 	}
+ 	return inode;
+ }
+ 
++static void cramfs_drop_inode(struct inode *inode)
++{
++	if (inode->i_ino == 1)
++		generic_delete_inode(inode);
++	else
++		generic_drop_inode(inode);
++}
++
+ /*
+  * We have our own block cache: don't fill up the buffer cache
+  * with the rom-image, because the way the filesystem is set
+@@ -535,6 +526,7 @@ static const struct super_operations cramfs_ops = {
+ 	.put_super	= cramfs_put_super,
+ 	.remount_fs	= cramfs_remount,
+ 	.statfs		= cramfs_statfs,
++	.drop_inode	= cramfs_drop_inode,
+ };
+ 
+ static int cramfs_get_sb(struct file_system_type *fs_type,
+diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
+index b6ed383..54b8b41 100644
+--- a/fs/nfsd/nfs4acl.c
++++ b/fs/nfsd/nfs4acl.c
+@@ -443,7 +443,7 @@ init_state(struct posix_acl_state *state, int cnt)
+ 	 * enough space for either:
+ 	 */
+ 	alloc = sizeof(struct posix_ace_state_array)
+-		+ cnt*sizeof(struct posix_ace_state);
++		+ cnt*sizeof(struct posix_user_ace_state);
+ 	state->users = kzalloc(alloc, GFP_KERNEL);
+ 	if (!state->users)
+ 		return -ENOMEM;
+diff --git a/include/linux/fb.h b/include/linux/fb.h
+index 58c57a3..e1ee345 100644
+--- a/include/linux/fb.h
++++ b/include/linux/fb.h
+@@ -966,6 +966,9 @@ static inline void __fb_pad_aligned_buffer(u8 *dst, u32 d_pitch,
+ 
+ /* drivers/video/fb_defio.c */
+ extern void fb_deferred_io_init(struct fb_info *info);
++extern void fb_deferred_io_open(struct fb_info *info,
++				struct inode *inode,
++				struct file *file);
+ extern void fb_deferred_io_cleanup(struct fb_info *info);
+ extern int fb_deferred_io_fsync(struct file *file, struct dentry *dentry,
+ 				int datasync);
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index f7082af..15ff806 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -717,6 +717,9 @@ int move_freepages(struct zone *zone,
+ #endif
+ 
+ 	for (page = start_page; page <= end_page;) {
++		/* Make sure we are not inadvertently changing nodes */
++		VM_BUG_ON(page_to_nid(page) != zone_to_nid(zone));
++
+ 		if (!pfn_valid_within(page_to_pfn(page))) {
+ 			page++;
+ 			continue;
+@@ -2476,6 +2479,10 @@ static void setup_zone_migrate_reserve(struct zone *zone)
+ 			continue;
+ 		page = pfn_to_page(pfn);
+ 
++		/* Watch out for overlapping nodes */
++		if (page_to_nid(page) != zone_to_nid(zone))
++			continue;
++
+ 		/* Blocks with reserved pages will never free, skip them. */
+ 		if (PageReserved(page))
+ 			continue;
+diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
+index 4aa2b45..d11f8d6 100644
+--- a/net/sched/sch_prio.c
++++ b/net/sched/sch_prio.c
+@@ -228,14 +228,20 @@ static int prio_tune(struct Qdisc *sch, struct nlattr *opt)
+ {
+ 	struct prio_sched_data *q = qdisc_priv(sch);
+ 	struct tc_prio_qopt *qopt;
+-	struct nlattr *tb[TCA_PRIO_MAX + 1];
++	struct nlattr *tb[TCA_PRIO_MAX + 1] = {0};
+ 	int err;
+ 	int i;
+ 
+-	err = nla_parse_nested_compat(tb, TCA_PRIO_MAX, opt, NULL, qopt,
+-				      sizeof(*qopt));
+-	if (err < 0)
+-		return err;
++	qopt = nla_data(opt);
++	if (nla_len(opt) < sizeof(*qopt))
++		return -1;
++
++	if (nla_len(opt) >= sizeof(*qopt) + sizeof(struct nlattr)) {
++		err = nla_parse_nested(tb, TCA_PRIO_MAX,
++				       (struct nlattr *) (qopt + 1), NULL);
++		if (err < 0)
++			return err;
++	}
+ 
+ 	q->bands = qopt->bands;
+ 	/* If we're multiqueue, make sure the number of incoming bands
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index 675a5c3..52db5f6 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -80,6 +80,10 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
+ {
+ 	struct sctp_auth_bytes *key;
+ 
++	/* Verify that we are not going to overflow INT_MAX */
++	if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes))
++		return NULL;
++
+ 	/* Allocate the shared key */
+ 	key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp);
+ 	if (!key)
+@@ -782,6 +786,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
+ 	for (i = 0; i < hmacs->shmac_num_idents; i++) {
+ 		id = hmacs->shmac_idents[i];
+ 
++		if (id > SCTP_AUTH_HMAC_ID_MAX)
++			return -EOPNOTSUPP;
++
+ 		if (SCTP_AUTH_HMAC_ID_SHA1 == id)
+ 			has_sha1 = 1;
+ 
+diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
+index e39a0cd..4c8d9f4 100644
+--- a/net/sctp/endpointola.c
++++ b/net/sctp/endpointola.c
+@@ -103,6 +103,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
+ 
+ 		/* Initialize the CHUNKS parameter */
+ 		auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS;
++		auth_chunks->param_hdr.length = htons(sizeof(sctp_paramhdr_t));
+ 
+ 		/* If the Add-IP functionality is enabled, we must
+ 		 * authenticate, ASCONF and ASCONF-ACK chunks
+@@ -110,8 +111,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
+ 		if (sctp_addip_enable) {
+ 			auth_chunks->chunks[0] = SCTP_CID_ASCONF;
+ 			auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK;
+-			auth_chunks->param_hdr.length =
+-					htons(sizeof(sctp_paramhdr_t) + 2);
++			auth_chunks->param_hdr.length += htons(2);
+ 		}
+ 	}
+ 
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 2d42260..f8c66d6 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -2983,6 +2983,9 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
+ {
+ 	struct sctp_authchunk val;
+ 
++	if (!sctp_auth_enable)
++		return -EACCES;
++
+ 	if (optlen != sizeof(struct sctp_authchunk))
+ 		return -EINVAL;
+ 	if (copy_from_user(&val, optval, optlen))
+@@ -3011,8 +3014,12 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
+ 				    int optlen)
+ {
+ 	struct sctp_hmacalgo *hmacs;
++	u32 idents;
+ 	int err;
+ 
++	if (!sctp_auth_enable)
++		return -EACCES;
++
+ 	if (optlen < sizeof(struct sctp_hmacalgo))
+ 		return -EINVAL;
+ 
+@@ -3025,8 +3032,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
+ 		goto out;
+ 	}
+ 
+-	if (hmacs->shmac_num_idents == 0 ||
+-	    hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) {
++	idents = hmacs->shmac_num_idents;
++	if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
++	    (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
+ 		err = -EINVAL;
+ 		goto out;
+ 	}
+@@ -3051,6 +3059,9 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
+ 	struct sctp_association *asoc;
+ 	int ret;
+ 
++	if (!sctp_auth_enable)
++		return -EACCES;
++
+ 	if (optlen <= sizeof(struct sctp_authkey))
+ 		return -EINVAL;
+ 
+@@ -3063,6 +3074,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
+ 		goto out;
+ 	}
+ 
++	if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
++		ret = -EINVAL;
++		goto out;
++	}
++
+ 	asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
+ 	if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
+ 		ret = -EINVAL;
+@@ -3088,6 +3104,9 @@ static int sctp_setsockopt_active_key(struct sock *sk,
+ 	struct sctp_authkeyid val;
+ 	struct sctp_association *asoc;
+ 
++	if (!sctp_auth_enable)
++		return -EACCES;
++
+ 	if (optlen != sizeof(struct sctp_authkeyid))
+ 		return -EINVAL;
+ 	if (copy_from_user(&val, optval, optlen))
+@@ -3113,6 +3132,9 @@ static int sctp_setsockopt_del_key(struct sock *sk,
+ 	struct sctp_authkeyid val;
+ 	struct sctp_association *asoc;
+ 
++	if (!sctp_auth_enable)
++		return -EACCES;
++
+ 	if (optlen != sizeof(struct sctp_authkeyid))
+ 		return -EINVAL;
+ 	if (copy_from_user(&val, optval, optlen))
+@@ -5073,19 +5095,29 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
+ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
+ 				    char __user *optval, int __user *optlen)
+ {
++	struct sctp_hmacalgo  __user *p = (void __user *)optval;
+ 	struct sctp_hmac_algo_param *hmacs;
+-	__u16 param_len;
++	__u16 data_len = 0;
++	u32 num_idents;
++
++	if (!sctp_auth_enable)
++		return -EACCES;
+ 
+ 	hmacs = sctp_sk(sk)->ep->auth_hmacs_list;
+-	param_len = ntohs(hmacs->param_hdr.length);
++	data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t);
+ 
+-	if (len < param_len)
++	if (len < sizeof(struct sctp_hmacalgo) + data_len)
+ 		return -EINVAL;
++
++	len = sizeof(struct sctp_hmacalgo) + data_len;
++	num_idents = data_len / sizeof(u16);
++
+ 	if (put_user(len, optlen))
+ 		return -EFAULT;
+-	if (copy_to_user(optval, hmacs->hmac_ids, len))
++	if (put_user(num_idents, &p->shmac_num_idents))
++		return -EFAULT;
++	if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
+ 		return -EFAULT;
+-
+ 	return 0;
+ }
+ 
+@@ -5095,6 +5127,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
+ 	struct sctp_authkeyid val;
+ 	struct sctp_association *asoc;
+ 
++	if (!sctp_auth_enable)
++		return -EACCES;
++
+ 	if (len < sizeof(struct sctp_authkeyid))
+ 		return -EINVAL;
+ 	if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
+@@ -5109,6 +5144,12 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
+ 	else
+ 		val.scact_keynumber = sctp_sk(sk)->ep->active_key_id;
+ 
++	len = sizeof(struct sctp_authkeyid);
++	if (put_user(len, optlen))
++		return -EFAULT;
++	if (copy_to_user(optval, &val, len))
++		return -EFAULT;
++
+ 	return 0;
+ }
+ 
+@@ -5119,13 +5160,16 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
+ 	struct sctp_authchunks val;
+ 	struct sctp_association *asoc;
+ 	struct sctp_chunks_param *ch;
+-	u32    num_chunks;
++	u32    num_chunks = 0;
+ 	char __user *to;
+ 
+-	if (len <= sizeof(struct sctp_authchunks))
++	if (!sctp_auth_enable)
++		return -EACCES;
++
++	if (len < sizeof(struct sctp_authchunks))
+ 		return -EINVAL;
+ 
+-	if (copy_from_user(&val, p, sizeof(struct sctp_authchunks)))
++	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
+ 		return -EFAULT;
+ 
+ 	to = p->gauth_chunks;
+@@ -5134,20 +5178,21 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
+ 		return -EINVAL;
+ 
+ 	ch = asoc->peer.peer_chunks;
++	if (!ch)
++		goto num;
+ 
+ 	/* See if the user provided enough room for all the data */
+ 	num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
+ 	if (len < num_chunks)
+ 		return -EINVAL;
+ 
+-	len = num_chunks;
+-	if (put_user(len, optlen))
++	if (copy_to_user(to, ch->chunks, num_chunks))
+ 		return -EFAULT;
++num:
++	len = sizeof(struct sctp_authchunks) + num_chunks;
++	if (put_user(len, optlen)) return -EFAULT;
+ 	if (put_user(num_chunks, &p->gauth_number_of_chunks))
+ 		return -EFAULT;
+-	if (copy_to_user(to, ch->chunks, len))
+-		return -EFAULT;
+-
+ 	return 0;
+ }
+ 
+@@ -5158,13 +5203,16 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
+ 	struct sctp_authchunks val;
+ 	struct sctp_association *asoc;
+ 	struct sctp_chunks_param *ch;
+-	u32    num_chunks;
++	u32    num_chunks = 0;
+ 	char __user *to;
+ 
+-	if (len <= sizeof(struct sctp_authchunks))
++	if (!sctp_auth_enable)
++		return -EACCES;
++
++	if (len < sizeof(struct sctp_authchunks))
+ 		return -EINVAL;
+ 
+-	if (copy_from_user(&val, p, sizeof(struct sctp_authchunks)))
++	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
+ 		return -EFAULT;
+ 
+ 	to = p->gauth_chunks;
+@@ -5177,17 +5225,21 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
+ 	else
+ 		ch = sctp_sk(sk)->ep->auth_chunk_list;
+ 
++	if (!ch)
++		goto num;
++
+ 	num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
+-	if (len < num_chunks)
++	if (len < sizeof(struct sctp_authchunks) + num_chunks)
+ 		return -EINVAL;
+ 
+-	len = num_chunks;
++	if (copy_to_user(to, ch->chunks, num_chunks))
++		return -EFAULT;
++num:
++	len = sizeof(struct sctp_authchunks) + num_chunks;
+ 	if (put_user(len, optlen))
+ 		return -EFAULT;
+ 	if (put_user(num_chunks, &p->gauth_number_of_chunks))
+ 		return -EFAULT;
+-	if (copy_to_user(to, ch->chunks, len))
+-		return -EFAULT;
+ 
+ 	return 0;
+ }
+diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
+index 0f8c439..5231f7a 100644
+--- a/net/sunrpc/sysctl.c
++++ b/net/sunrpc/sysctl.c
+@@ -60,24 +60,14 @@ static int proc_do_xprt(ctl_table *table, int write, struct file *file,
+ 			void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+ 	char tmpbuf[256];
+-	int len;
++	size_t len;
++
+ 	if ((*ppos && !write) || !*lenp) {
+ 		*lenp = 0;
+ 		return 0;
+ 	}
+-	if (write)
+-		return -EINVAL;
+-	else {
+-		len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
+-		if (!access_ok(VERIFY_WRITE, buffer, len))
+-			return -EFAULT;
+-
+-		if (__copy_to_user(buffer, tmpbuf, len))
+-			return -EFAULT;
+-	}
+-	*lenp -= len;
+-	*ppos += len;
+-	return 0;
++	len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
++	return simple_read_from_buffer(buffer, *lenp, ppos, tmpbuf, len);
+ }
+ 
+ static int

Added: genpatches-2.6/trunk/2.6.25/1500_thinkpad_acpi-null-ptr-deref-fix.patch
===================================================================
--- genpatches-2.6/trunk/2.6.25/1500_thinkpad_acpi-null-ptr-deref-fix.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.25/1500_thinkpad_acpi-null-ptr-deref-fix.patch	2008-10-06 11:16:31 UTC (rev 1345)
@@ -0,0 +1,27 @@
+From: Cyrill Gorcunov <gorcunov@×××××.com>
+Date: Fri, 18 Apr 2008 20:27:29 +0000 (-0700)
+Subject: thinkpad_acpi: fix possible NULL pointer dereference if kstrdup failed
+X-Git-Tag: v2.6.26-rc1~101^2~1^8~3
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=90fe17f4df2f830601ffd422b11d1f7f9a9d0355
+
+thinkpad_acpi: fix possible NULL pointer dereference if kstrdup failed
+
+Signed-off-by: Cyrill Gorcunov <gorcunov@×××××.com>
+Acked-by: Henrique de Moraes Holschuh <hmh@×××××××.br>
+Signed-off-by: Andrew Morton <akpm@××××××××××××××××.org>
+Signed-off-by: Len Brown <len.brown@×××××.com>
+---
+
+diff --git a/drivers/misc/thinkpad_acpi.c b/drivers/misc/thinkpad_acpi.c
+index 6cb7812..31115c9 100644
+--- a/drivers/misc/thinkpad_acpi.c
++++ b/drivers/misc/thinkpad_acpi.c
+@@ -5826,7 +5826,7 @@ static void __init get_thinkpad_model_data(struct thinkpad_id_data *tp)
+ 
+ 	tp->model_str = kstrdup(dmi_get_system_info(DMI_PRODUCT_VERSION),
+ 					GFP_KERNEL);
+-	if (strnicmp(tp->model_str, "ThinkPad", 8) != 0) {
++	if (tp->model_str && strnicmp(tp->model_str, "ThinkPad", 8) != 0) {
+ 		kfree(tp->model_str);
+ 		tp->model_str = NULL;
+ 	}

Added: genpatches-2.6/trunk/2.6.25/1501_nfs-validate_mount_data-null-ptr-deref-fixes.patch
===================================================================
--- genpatches-2.6/trunk/2.6.25/1501_nfs-validate_mount_data-null-ptr-deref-fixes.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.25/1501_nfs-validate_mount_data-null-ptr-deref-fixes.patch	2008-10-06 11:16:31 UTC (rev 1345)
@@ -0,0 +1,77 @@
+From: Cyrill Gorcunov <gorcunov@×××××.com>
+Date: Thu, 17 Apr 2008 16:42:09 +0000 (+0400)
+Subject: NFS - fix potential NULL pointer dereference v2
+X-Git-Tag: v2.6.26-rc1~1082^2^2~3
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=63649bd7080a6a50fabcb1935f4b7c4e64155066
+
+NFS - fix potential NULL pointer dereference v2
+
+There is possible NULL pointer dereference if kstr[n]dup failed.
+So fix them for safety.
+
+Signed-off-by: Cyrill Gorcunov <gorcunov@×××××.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@××××××.com>
+---
+
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index c99ca1f..2215bcd 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1297,6 +1297,8 @@ static int nfs_validate_mount_data(void *options,
+ 		args->namlen		= data->namlen;
+ 		args->bsize		= data->bsize;
+ 		args->auth_flavors[0]	= data->pseudoflavor;
++		if (!args->nfs_server.hostname)
++			goto out_nomem;
+ 
+ 		/*
+ 		 * The legacy version 6 binary mount data from userspace has a
+@@ -1343,6 +1345,8 @@ static int nfs_validate_mount_data(void *options,
+ 		len = c - dev_name;
+ 		/* N.B. caller will free nfs_server.hostname in all cases */
+ 		args->nfs_server.hostname = kstrndup(dev_name, len, GFP_KERNEL);
++		if (!args->nfs_server.hostname)
++			goto out_nomem;
+ 
+ 		c++;
+ 		if (strlen(c) > NFS_MAXPATHLEN)
+@@ -1386,6 +1390,10 @@ out_v3_not_compiled:
+ 	return -EPROTONOSUPPORT;
+ #endif /* !CONFIG_NFS_V3 */
+ 
++out_nomem:
++	dfprintk(MOUNT, "NFS: not enough memory to handle mount options\n");
++	return -ENOMEM;
++
+ out_no_address:
+ 	dfprintk(MOUNT, "NFS: mount program didn't pass remote address\n");
+ 	return -EINVAL;
+@@ -1892,12 +1900,16 @@ static int nfs4_validate_mount_data(void *options,
+ 			return -ENAMETOOLONG;
+ 		/* N.B. caller will free nfs_server.hostname in all cases */
+ 		args->nfs_server.hostname = kstrndup(dev_name, len, GFP_KERNEL);
++		if (!args->nfs_server.hostname)
++			goto out_nomem;
+ 
+ 		c++;			/* step over the ':' */
+ 		len = strlen(c);
+ 		if (len > NFS4_MAXPATHLEN)
+ 			return -ENAMETOOLONG;
+ 		args->nfs_server.export_path = kstrndup(c, len, GFP_KERNEL);
++		if (!args->nfs_server.export_path)
++			goto out_nomem;
+ 
+ 		dprintk("NFS: MNTPATH: '%s'\n", args->nfs_server.export_path);
+ 
+@@ -1919,6 +1931,10 @@ out_inval_auth:
+ 		 data->auth_flavourlen);
+ 	return -EINVAL;
+ 
++out_nomem:
++	dfprintk(MOUNT, "NFS4: not enough memory to handle mount options\n");
++	return -ENOMEM;
++
+ out_no_address:
+ 	dfprintk(MOUNT, "NFS4: mount program didn't pass remote address\n");
+ 	return -EINVAL;
+

Added: genpatches-2.6/trunk/2.6.25/1502_wan-sbni_ioctl-add-missing-capability-checks.patch
===================================================================
--- genpatches-2.6/trunk/2.6.25/1502_wan-sbni_ioctl-add-missing-capability-checks.patch	                        (rev 0)
+++ genpatches-2.6/trunk/2.6.25/1502_wan-sbni_ioctl-add-missing-capability-checks.patch	2008-10-06 11:16:31 UTC (rev 1345)
@@ -0,0 +1,79 @@
+From: Eugene Teo <eugeneteo@××××××.sg>
+Date: Wed, 27 Aug 2008 11:50:30 +0000 (-0700)
+Subject: wan: Missing capability checks in sbni_ioctl()
+X-Git-Tag: v2.6.27-rc5~8^2~2
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=f2455eb176ac87081bbfc9a44b21c7cd2bc1967e
+
+wan: Missing capability checks in sbni_ioctl()
+
+There are missing capability checks in the following code:
+
+1300 static int
+1301 sbni_ioctl( struct net_device  *dev,  struct ifreq  *ifr,  int  cmd)
+1302 {
+[...]
+1319     case  SIOCDEVRESINSTATS :
+1320         if( current->euid != 0 )    /* root only */
+1321             return  -EPERM;
+[...]
+1336     case  SIOCDEVSHWSTATE :
+1337         if( current->euid != 0 )    /* root only */
+1338             return  -EPERM;
+[...]
+1357     case  SIOCDEVENSLAVE :
+1358         if( current->euid != 0 )    /* root only */
+1359             return  -EPERM;
+[...]
+1372     case  SIOCDEVEMANSIPATE :
+1373         if( current->euid != 0 )    /* root only */
+1374             return  -EPERM;
+
+Here's my proposed fix:
+
+Missing capability checks.
+
+Signed-off-by: Eugene Teo <eugeneteo@××××××.sg>
+Signed-off-by: David S. Miller <davem@×××××××××.net>
+---
+
+diff --git a/drivers/net/wan/sbni.c b/drivers/net/wan/sbni.c
+index e59255a..6596cd0 100644
+--- a/drivers/net/wan/sbni.c
++++ b/drivers/net/wan/sbni.c
+@@ -1317,7 +1317,7 @@ sbni_ioctl( struct net_device  *dev,  struct ifreq  *ifr,  int  cmd )
+ 		break;
+ 
+ 	case  SIOCDEVRESINSTATS :
+-		if( current->euid != 0 )	/* root only */
++		if (!capable(CAP_NET_ADMIN))
+ 			return  -EPERM;
+ 		memset( &nl->in_stats, 0, sizeof(struct sbni_in_stats) );
+ 		break;
+@@ -1334,7 +1334,7 @@ sbni_ioctl( struct net_device  *dev,  struct ifreq  *ifr,  int  cmd )
+ 		break;
+ 
+ 	case  SIOCDEVSHWSTATE :
+-		if( current->euid != 0 )	/* root only */
++		if (!capable(CAP_NET_ADMIN))
+ 			return  -EPERM;
+ 
+ 		spin_lock( &nl->lock );
+@@ -1355,7 +1355,7 @@ sbni_ioctl( struct net_device  *dev,  struct ifreq  *ifr,  int  cmd )
+ #ifdef CONFIG_SBNI_MULTILINE
+ 
+ 	case  SIOCDEVENSLAVE :
+-		if( current->euid != 0 )	/* root only */
++		if (!capable(CAP_NET_ADMIN))
+ 			return  -EPERM;
+ 
+ 		if (copy_from_user( slave_name, ifr->ifr_data, sizeof slave_name ))
+@@ -1370,7 +1370,7 @@ sbni_ioctl( struct net_device  *dev,  struct ifreq  *ifr,  int  cmd )
+ 		return  enslave( dev, slave_dev );
+ 
+ 	case  SIOCDEVEMANSIPATE :
+-		if( current->euid != 0 )	/* root only */
++		if (!capable(CAP_NET_ADMIN))
+ 			return  -EPERM;
+ 
+ 		return  emancipate( dev );
+