rpms/kernel/F-11 posix-timers-fix-oops-in-clock_nanosleep.patch, NONE, 1.1.2.1 kernel.spec, 1.1679.2.7, 1.1679.2.8

[Kyle McMartin]

Author: kyle

Update of /cvs/pkgs/rpms/kernel/F-11
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv16395

Modified Files:
      Tag: private-fedora-11-2_6_29_6
	kernel.spec 
Added Files:
      Tag: private-fedora-11-2_6_29_6
	posix-timers-fix-oops-in-clock_nanosleep.patch 
Log Message:
* Sat Aug 15 2009 Kyle McMartin <kyle at redhat.com> 2.6.29.6-217.2.8
- CVE-2009-2767: Fix clock_nanosleep NULL ptr deref.


posix-timers-fix-oops-in-clock_nanosleep.patch:
 posix-timers.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- NEW FILE posix-timers-fix-oops-in-clock_nanosleep.patch ---
From: Hiroshi Shimamoto <h-shimamoto at ct.jp.nec.com>
Date: Mon, 3 Aug 2009 02:48:19 +0000 (+0900)
Subject: posix-timers: Fix oops in clock_nanosleep() with CLOCK_MONOTONIC_RAW
X-Git-Tag: v2.6.31-rc6~76^2
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=70d715fd0597f18528f389b5ac59102263067744

posix-timers: Fix oops in clock_nanosleep() with CLOCK_MONOTONIC_RAW

Prevent calling do_nanosleep() with clockid
CLOCK_MONOTONIC_RAW, it may cause oops, such as NULL pointer
dereference.

Signed-off-by: Hiroshi Shimamoto <h-shimamoto at ct.jp.nec.com>
Cc: Andrew Morton <akpm at linux-foundation.org>
Cc: Thomas Gleixner <tglx at linutronix.de>
Cc: John Stultz <johnstul at us.ibm.com>
Cc: <stable at kernel.org>
LKML-Reference: <4A764FF3.50607 at ct.jp.nec.com>
Signed-off-by: Ingo Molnar <mingo at elte.hu>
---

diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 052ec4d..d089d05 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -202,6 +202,12 @@ static int no_timer_create(struct k_itimer *new_timer)
 	return -EOPNOTSUPP;
 }
 
+static int no_nsleep(const clockid_t which_clock, int flags,
+		     struct timespec *tsave, struct timespec __user *rmtp)
+{
+	return -EOPNOTSUPP;
+}
+
 /*
  * Return nonzero if we know a priori this clockid_t value is bogus.
  */
@@ -254,6 +260,7 @@ static __init int init_posix_timers(void)
 		.clock_get = posix_get_monotonic_raw,
 		.clock_set = do_posix_clock_nosettime,
 		.timer_create = no_timer_create,
+		.nsleep = no_nsleep,
 	};
 
 	register_posix_clock(CLOCK_REALTIME, &clock_realtime);


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-11/kernel.spec,v
retrieving revision 1.1679.2.7
retrieving revision 1.1679.2.8
diff -u -p -r1.1679.2.7 -r1.1679.2.8
--- kernel.spec	15 Aug 2009 00:27:03 -0000	1.1679.2.7
+++ kernel.spec	15 Aug 2009 04:33:06 -0000	1.1679.2.8
@@ -610,6 +610,7 @@ Patch30: linux-2.6-iommu-fixes.patch
 Patch41: linux-2.6-sysrq-c.patch
 
 Patch50: make-sock_sendpage-use-kernel_sendpage.patch
+Patch51: posix-timers-fix-oops-in-clock_nanosleep.patch
 
 #Patch101: linux-2.6-e820-save-restore-edi-ebp.patch
 #Patch102: linux-2.6-e820-acpi3-bios-workaround.patch
@@ -1544,6 +1545,7 @@ ApplyPatch personality-fix-per_clear_on_
 ApplyPatch add-fno-delete-null-pointer-checks-to-gcc-cflags.patch
 
 ApplyPatch make-sock_sendpage-use-kernel_sendpage.patch
+ApplyPatch posix-timers-fix-oops-in-clock_nanosleep.patch
 
 # VIA: add 64-bit padlock support, sdmmc driver, temp sensor driver
 ApplyPatch via-centaur-merge-32-64-bit-init.patch
@@ -2142,6 +2144,9 @@ fi
 # and build.
 
 %changelog
+* Sat Aug 15 2009 Kyle McMartin <kyle at redhat.com> 2.6.29.6-217.2.8
+- CVE-2009-2767: Fix clock_nanosleep NULL ptr deref.
+
 * Fri Aug 14 2009 Kyle McMartin <kyle at redhat.com> 2.6.29.6-217.2.7
 - CVE-2009-2692: Fix sock sendpage NULL ptr deref.