- patch resolving CVE-2011-1927

Changed files:
    kernel-CVE-2011-1927.patch -> 1.1

diff --git a/kernel-CVE-2011-1927.patch b/kernel-CVE-2011-1927.patch
new file mode 100644 (file)
index 0000000..7e16da5
--- /dev/null
+++ b/kernel-CVE-2011-1927.patch
@@ -0,0 +1,52 @@
+diff -ur linux-2.6.38-orig/net/ipv4/ip_fragment.c linux-2.6.38/net/ipv4/ip_fragment.c
+--- linux-2.6.38-orig/net/ipv4/ip_fragment.c   2011-03-15 02:20:32.000000000 +0100
++++ linux-2.6.38/net/ipv4/ip_fragment.c        2011-05-19 22:17:57.229544248 +0200
+@@ -223,32 +223,31 @@
+ 
+       if ((qp->q.last_in & INET_FRAG_FIRST_IN) && qp->q.fragments != NULL) {
+               struct sk_buff *head = qp->q.fragments;
++              const struct iphdr *iph;
++              int err;
+ 
+               rcu_read_lock();
+               head->dev = dev_get_by_index_rcu(net, qp->iif);
+               if (!head->dev)
+                       goto out_rcu_unlock;
++              
++              /* skb dst is stale, drop it, and perform route lookup again */
++              skb_dst_drop(head);
++              iph = ip_hdr(head);
++              err = ip_route_input_noref(head, iph->daddr, iph->saddr,
++                                                                      iph->tos, head->dev);
++              if (err)
++                              goto out_rcu_unlock;
+ 
+               /*
+-               * Only search router table for the head fragment,
+-               * when defraging timeout at PRE_ROUTING HOOK.
++               * Only an end host needs to send an ICMP
++               * "Fragment Reassembly Timeout" message, per RFC792.
+                */
+-              if (qp->user == IP_DEFRAG_CONNTRACK_IN && !skb_dst(head)) {
+-                      const struct iphdr *iph = ip_hdr(head);
+-                      int err = ip_route_input(head, iph->daddr, iph->saddr,
+-                                               iph->tos, head->dev);
+-                      if (unlikely(err))
+-                              goto out_rcu_unlock;
+-
+-                      /*
+-                       * Only an end host needs to send an ICMP
+-                       * "Fragment Reassembly Timeout" message, per RFC792.
+-                       */
+-                      if (skb_rtable(head)->rt_type != RTN_LOCAL)
++              
++              if (qp->user == IP_DEFRAG_CONNTRACK_IN &&
++                      skb_rtable(head)->rt_type != RTN_LOCAL)
+                               goto out_rcu_unlock;
+ 
+-              }
+-
+               /* Send an ICMP "Fragment Reassembly Timeout" message. */
+               icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
+ out_rcu_unlock:
+Tylko w linux-2.6.38/net/ipv4: ip_fragment.c~