 |
|
 |
|
On Wed, 01 Feb 2012 05:52:40 -0700, Tim Gardner <...@gmail.com
--
Tim Gardner tim....@canonical.com
--
kernel-team mailing list
kern...@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team
|
|
 |
|
 |
|
|
|
|
On Wed, 1 Feb 2012 10:28:44 +0000, Andy Whitcroft <...@canonical.com
From: Herbert Xu <...@gondor.apana.org.au
The list mp-is active on the bridge interface itself as opposed to one of the
constituent interfaces in the bridge.
Unfortunately the operation that adds the mp-list neglected to check whether it has already been added. This
leads to list corruption in the form of nodes pointing to itself.
Normally this would be quite obvious as it would cause an infinite
loop when walking the list. However, as this list is never actually
walked (which means that we don't really need it, I'll get rid of
it in a subsequent patch), this instead is hidden until we perform
a delete operation on the affected nodes.
As the same node may now be pointed to by more than one node, the
delete operations can then cause modification of freed memory.
This was observed in practice to cause corruption in 512-byte slabs,
most commonly leading to crashes in jbd2.
Thanks to Josef Bacik for pointing me in the right direction.
Reported-by: Ian Page Hands <...@redhat.comSigned-off-by: Herbert Xu <...@gondor.apana.org.auSigned-off-by: David S. Miller <...@davemloft.net
(cherry picked from commit 6b0d6a9b4296fa16a28d10d416db7a770fc03287)
CVE-2011-0716
BugLink: http://bugs.launchpad.net/bugs/917813
Signed-off-by: Andy Whitcroft <...@canonical.com---
net/bridge/br_multicast.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 382a428..2cba899 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -707,7 +707,8 @@ static int br_multicast_add_group(struct net_bridge *br,
goto err;
if (!port) {
- hlist_add_head(&mp-+ if (hlist_unhashed(&mp-+ hlist_add_head(&mp- mod_timer(&mp- goto out;
}
--
1.7.5.4
--
kernel-team mailing list
kern...@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team
|
|
|
|
|
|
|
|
|
On Wed, 1 Feb 2012 09:46:44 -0200, Herton Ronaldo Krzesinski <...@canonical.com
--
kernel-team mailing list
kern...@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team
|
|
|
|
|
|
|