summaryrefslogtreecommitdiffstats
path: root/main/linux-grsec
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2011-10-31 10:34:21 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2011-10-31 10:36:48 +0000
commit40c30bcc16651fe46abd6d94926e190add4f2ba9 (patch)
tree1d7723f57e4867bd3a5994528e31a0d156f6e317 /main/linux-grsec
parent46b45171f76a76651dffa4931f8fd5bfba18b51b (diff)
downloadaports-40c30bcc16651fe46abd6d94926e190add4f2ba9.tar.bz2
aports-40c30bcc16651fe46abd6d94926e190add4f2ba9.tar.xz
main/linux-grsec: backport ipsec regression fix + gre fix
Diffstat (limited to 'main/linux-grsec')
-rw-r--r--main/linux-grsec/0001-ip_gre-dont-increase-dev-needed_headroom-on-a-live-d.patch50
-rw-r--r--main/linux-grsec/0001-ipv4-fix-ipsec-forward-performance-regression.patch44
-rw-r--r--main/linux-grsec/APKBUILD6
3 files changed, 99 insertions, 1 deletions
diff --git a/main/linux-grsec/0001-ip_gre-dont-increase-dev-needed_headroom-on-a-live-d.patch b/main/linux-grsec/0001-ip_gre-dont-increase-dev-needed_headroom-on-a-live-d.patch
new file mode 100644
index 000000000..d43160f1f
--- /dev/null
+++ b/main/linux-grsec/0001-ip_gre-dont-increase-dev-needed_headroom-on-a-live-d.patch
@@ -0,0 +1,50 @@
+From 113ab386c7d6625cff284fb10952ff69a58c18a4 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Fri, 14 Oct 2011 04:57:46 +0000
+Subject: [PATCH] ip_gre: dont increase dev->needed_headroom on a live device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It seems ip_gre is able to change dev->needed_headroom on the fly.
+
+Its is not legal unfortunately and triggers a BUG in raw_sendmsg()
+
+skb = sock_alloc_send_skb(sk, ... + LL_ALLOCATED_SPACE(rt->dst.dev)
+
+< another cpu change dev->needed_headromm (making it bigger)
+
+...
+skb_reserve(skb, LL_RESERVED_SPACE(rt->dst.dev));
+
+We end with LL_RESERVED_SPACE() being bigger than LL_ALLOCATED_SPACE()
+-> we crash later because skb head is exhausted.
+
+Bug introduced in commit 243aad83 in 2.6.34 (ip_gre: include route
+header_len in max_headroom calculation)
+
+Reported-by: Elmar Vonlanthen <evonlanthen@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+CC: Timo Teräs <timo.teras@iki.fi>
+CC: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/ipv4/ip_gre.c | 2 --
+ 1 files changed, 0 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index d7bb94c..d55110e 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -835,8 +835,6 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
+ if (skb_headroom(skb) < max_headroom || skb_shared(skb)||
+ (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
+ struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
+- if (max_headroom > dev->needed_headroom)
+- dev->needed_headroom = max_headroom;
+ if (!new_skb) {
+ ip_rt_put(rt);
+ dev->stats.tx_dropped++;
+--
+1.7.7
+
diff --git a/main/linux-grsec/0001-ipv4-fix-ipsec-forward-performance-regression.patch b/main/linux-grsec/0001-ipv4-fix-ipsec-forward-performance-regression.patch
new file mode 100644
index 000000000..678662c27
--- /dev/null
+++ b/main/linux-grsec/0001-ipv4-fix-ipsec-forward-performance-regression.patch
@@ -0,0 +1,44 @@
+From b73233960a59ee66e09d642f13d0592b13651e94 Mon Sep 17 00:00:00 2001
+From: "Yan, Zheng" <zheng.z.yan@intel.com>
+Date: Sat, 22 Oct 2011 21:58:20 +0000
+Subject: [PATCH] ipv4: fix ipsec forward performance regression
+
+There is bug in commit 5e2b61f(ipv4: Remove flowi from struct rtable).
+It makes xfrm4_fill_dst() modify wrong data structure.
+
+Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
+Reported-by: Kim Phillips <kim.phillips@freescale.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/ipv4/xfrm4_policy.c | 14 +++++++-------
+ 1 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
+index fc5368a..a0b4c5d 100644
+--- a/net/ipv4/xfrm4_policy.c
++++ b/net/ipv4/xfrm4_policy.c
+@@ -79,13 +79,13 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
+ struct rtable *rt = (struct rtable *)xdst->route;
+ const struct flowi4 *fl4 = &fl->u.ip4;
+
+- rt->rt_key_dst = fl4->daddr;
+- rt->rt_key_src = fl4->saddr;
+- rt->rt_key_tos = fl4->flowi4_tos;
+- rt->rt_route_iif = fl4->flowi4_iif;
+- rt->rt_iif = fl4->flowi4_iif;
+- rt->rt_oif = fl4->flowi4_oif;
+- rt->rt_mark = fl4->flowi4_mark;
++ xdst->u.rt.rt_key_dst = fl4->daddr;
++ xdst->u.rt.rt_key_src = fl4->saddr;
++ xdst->u.rt.rt_key_tos = fl4->flowi4_tos;
++ xdst->u.rt.rt_route_iif = fl4->flowi4_iif;
++ xdst->u.rt.rt_iif = fl4->flowi4_iif;
++ xdst->u.rt.rt_oif = fl4->flowi4_oif;
++ xdst->u.rt.rt_mark = fl4->flowi4_mark;
+
+ xdst->u.dst.dev = dev;
+ dev_hold(dev);
+--
+1.7.7
+
diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index a4919bdbb..d56b78993 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -4,7 +4,7 @@ _flavor=grsec
pkgname=linux-${_flavor}
pkgver=3.0.8
_kernver=3.0
-pkgrel=0
+pkgrel=1
pkgdesc="Linux kernel with grsecurity"
url=http://grsecurity.net
depends="mkinitfs linux-firmware"
@@ -17,6 +17,8 @@ source="ftp://ftp.kernel.org/pub/linux/kernel/v3.0/linux-$_kernver.tar.bz2
grsecurity-2.2.2-3.0.8-201110250925.patch
grsec-timblogiw-noconst.patch
+ 0001-ip_gre-dont-increase-dev-needed_headroom-on-a-live-d.patch
+ 0001-ipv4-fix-ipsec-forward-performance-regression.patch
0004-arp-flush-arp-cache-on-device-change.patch
kernelconfig.x86
@@ -141,6 +143,8 @@ md5sums="398e95866794def22b12dfbc15ce89c0 linux-3.0.tar.bz2
49618d8c7a71549c8870eb709c7d3f81 patch-3.0.8.bz2
5015a2afce7d3665bf74e0896529fb90 grsecurity-2.2.2-3.0.8-201110250925.patch
c41cf0ee9794f393423c6b2093072260 grsec-timblogiw-noconst.patch
+ebb99ef6ad8cd2d9fd8f49d5c5849057 0001-ip_gre-dont-increase-dev-needed_headroom-on-a-live-d.patch
+b27bc150f7a3932de28fcb8803809cbc 0001-ipv4-fix-ipsec-forward-performance-regression.patch
776adeeb5272093574f8836c5037dd7d 0004-arp-flush-arp-cache-on-device-change.patch
0134b22fc2c95106803f4043cffed087 kernelconfig.x86
d97d1808eebdfb97734dccfbcaea35f2 kernelconfig.x86_64"