Your message dated Thu, 24 May 2007 21:27:01 +0000 with message-id <[EMAIL PROTECTED]> and subject line Bug#421283: fixed in linux-2.6 2.6.18.dfsg.1-13lenny1 has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database)
--- Begin Message ---Package: linux-2.6 This is needed for our 2.6.18 kernel in etch. ----- Forwarded message from Dave Johnson <[EMAIL PROTECTED]> ----- From: Dave Johnson <[EMAIL PROTECTED]> Subject: [PATCH] Fix wrong checksum for split TCP packets on 64-bit MIPS Date: Wed, 18 Apr 2007 10:39:41 -0400 To: [EMAIL PROTECTED], Ralf Baechle <[EMAIL PROTECTED]> X-Mailer: VM 7.17 under 21.4 (patch 17) "Jumbo Shrimp" XEmacs Lucid I've traced down an off-by-one TCP checksum calculation error under the following conditions: 1) The TCP code needs to split a full-sized packet due to a reduced MSS (typically due to the addition of TCP options mid-stream like SACK). _AND_ 2) The checksum of the 2nd fragment is larger than the checksum of the original packet. After subtraction this results in a checksum for the 1st fragment with bits 16..31 set to 1. (this is ok) _AND_ 3) The checksum of the 1st fragment's TCP header plus the previously 32bit checksum of the 1st fragment DOES NOT cause a 32bit overflow when added together. This results in a checksum of the TCP header plus TCP data that still has the upper 16 bits as 1's. _THEN_ 4) The TCP+data checksum is added to the checksum of the pseudo IP header with csum_tcpudp_nofold() incorrectly (the bug). The problem is the checksum of the TCP+data is passed to csum_tcpudp_nofold() as an 32bit unsigned value, however the assembly code acts on it as if it is a 64bit unsigned value. This causes an incorrect 32->64bit extension if the sum has bit 31 set. The resulting checksum is off by one. This problems is data and TCP header dependent due to #2 and #3 above so it doesn't occur on every TCP packet split. Patch below is against 2.6.20, however this problem looks like it's been around since at least Aug 2003 when the 64bit ASM was added to csum_tcpudp_nofold(). Signed-off-by: Dave Johnson <[EMAIL PROTECTED]> --- old/include/asm-mips/checksum.h 2007-01-24 14:23:22 -05:00 +++ new/include/asm-mips/checksum.h 2007-04-18 10:31:27 -04:00 @@ -166,7 +166,7 @@ #else "r" (proto + len), #endif - "r" (sum)); + "r" ((__force unsigned long)sum)); return sum; } ----- End forwarded message ----- ----- Forwarded message from Ralf Baechle <[EMAIL PROTECTED]> ----- From: Ralf Baechle <[EMAIL PROTECTED]> Subject: Re: [PATCH] Fix wrong checksum for split TCP packets on 64-bit MIPS Date: Wed, 18 Apr 2007 17:17:07 +0100 To: Dave Johnson <[EMAIL PROTECTED]> Cc: [EMAIL PROTECTED] User-Agent: Mutt/1.4.2.2i On Wed, Apr 18, 2007 at 10:39:41AM -0400, Dave Johnson wrote: > the following conditions: > > 1) The TCP code needs to split a full-sized packet due to a reduced > MSS (typically due to the addition of TCP options mid-stream like > SACK). > _AND_ > 2) The checksum of the 2nd fragment is larger than the checksum of the > original packet. After subtraction this results in a checksum for > the 1st fragment with bits 16..31 set to 1. (this is ok) > _AND_ > 3) The checksum of the 1st fragment's TCP header plus the previously > 32bit checksum of the 1st fragment DOES NOT cause a 32bit overflow > when added together. This results in a checksum of the TCP header > plus TCP data that still has the upper 16 bits as 1's. > _THEN_ > 4) The TCP+data checksum is added to the checksum of the pseudo IP > header with csum_tcpudp_nofold() incorrectly (the bug). > > The problem is the checksum of the TCP+data is passed to > csum_tcpudp_nofold() as an 32bit unsigned value, however the assembly > code acts on it as if it is a 64bit unsigned value. > > This causes an incorrect 32->64bit extension if the sum has bit 31 > set. The resulting checksum is off by one. Sigh. The second bug of this kind. As clever and apparently elegent as the sign extension stuff happens to look on MIPS as prone to unobvious accidents it is at times. Oh well. Applied & thanks! Ralf ----- End forwarded message ----- -- Martin Michlmayr http://www.cyrius.com/
--- End Message ---
--- Begin Message ---Source: linux-2.6 Source-Version: 2.6.18.dfsg.1-13lenny1 We believe that the bug you reported is fixed in the latest version of linux-2.6, which is due to be installed in the Debian FTP archive: linux-2.6_2.6.18.dfsg.1-13lenny1.diff.gz to pool/main/l/linux-2.6/linux-2.6_2.6.18.dfsg.1-13lenny1.diff.gz linux-2.6_2.6.18.dfsg.1-13lenny1.dsc to pool/main/l/linux-2.6/linux-2.6_2.6.18.dfsg.1-13lenny1.dsc linux-doc-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb to pool/main/l/linux-2.6/linux-doc-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb linux-headers-2.6.18-5-all-sparc_2.6.18.dfsg.1-13lenny1_sparc.deb to pool/main/l/linux-2.6/linux-headers-2.6.18-5-all-sparc_2.6.18.dfsg.1-13lenny1_sparc.deb linux-headers-2.6.18-5-all_2.6.18.dfsg.1-13lenny1_sparc.deb to pool/main/l/linux-2.6/linux-headers-2.6.18-5-all_2.6.18.dfsg.1-13lenny1_sparc.deb linux-headers-2.6.18-5-sparc32_2.6.18.dfsg.1-13lenny1_sparc.deb to pool/main/l/linux-2.6/linux-headers-2.6.18-5-sparc32_2.6.18.dfsg.1-13lenny1_sparc.deb linux-headers-2.6.18-5-sparc64-smp_2.6.18.dfsg.1-13lenny1_sparc.deb to pool/main/l/linux-2.6/linux-headers-2.6.18-5-sparc64-smp_2.6.18.dfsg.1-13lenny1_sparc.deb linux-headers-2.6.18-5-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb to pool/main/l/linux-2.6/linux-headers-2.6.18-5-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb linux-headers-2.6.18-5-vserver-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb to pool/main/l/linux-2.6/linux-headers-2.6.18-5-vserver-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb linux-headers-2.6.18-5-vserver_2.6.18.dfsg.1-13lenny1_sparc.deb to pool/main/l/linux-2.6/linux-headers-2.6.18-5-vserver_2.6.18.dfsg.1-13lenny1_sparc.deb linux-headers-2.6.18-5_2.6.18.dfsg.1-13lenny1_sparc.deb to pool/main/l/linux-2.6/linux-headers-2.6.18-5_2.6.18.dfsg.1-13lenny1_sparc.deb linux-image-2.6.18-5-sparc32_2.6.18.dfsg.1-13lenny1_sparc.deb to pool/main/l/linux-2.6/linux-image-2.6.18-5-sparc32_2.6.18.dfsg.1-13lenny1_sparc.deb linux-image-2.6.18-5-sparc64-smp_2.6.18.dfsg.1-13lenny1_sparc.deb to pool/main/l/linux-2.6/linux-image-2.6.18-5-sparc64-smp_2.6.18.dfsg.1-13lenny1_sparc.deb linux-image-2.6.18-5-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb to pool/main/l/linux-2.6/linux-image-2.6.18-5-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb linux-image-2.6.18-5-vserver-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb to pool/main/l/linux-2.6/linux-image-2.6.18-5-vserver-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb linux-manual-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb to pool/main/l/linux-2.6/linux-manual-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb linux-patch-debian-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb to pool/main/l/linux-2.6/linux-patch-debian-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb linux-source-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb to pool/main/l/linux-2.6/linux-source-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb linux-support-2.6.18-5_2.6.18.dfsg.1-13lenny1_all.deb to pool/main/l/linux-2.6/linux-support-2.6.18-5_2.6.18.dfsg.1-13lenny1_all.deb linux-tree-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb to pool/main/l/linux-2.6/linux-tree-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [EMAIL PROTECTED], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. dann frazier <[EMAIL PROTECTED]> (supplier of updated linux-2.6 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [EMAIL PROTECTED]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Mon, 21 May 2007 14:45:13 -0600 Source: linux-2.6 Binary: linux-image-2.6.18-5-s3c2410 linux-headers-2.6.18-5-all-s390 linux-headers-2.6.18-5-all-m68k linux-headers-2.6.18-5-xen-amd64 linux-image-2.6.18-5-iop32x linux-headers-2.6.18-5-all-alpha linux-image-2.6.18-5-r5k-cobalt linux-image-2.6.18-5-r5k-ip32 linux-headers-2.6.18-5-vserver-686 linux-headers-2.6.18-5-xen-vserver xen-linux-system-2.6.18-5-xen-686 linux-image-2.6.18-5-xen-amd64 linux-image-2.6.18-5-powerpc xen-linux-system-2.6.18-5-xen-vserver-686 linux-image-2.6.18-5-atari linux-headers-2.6.18-5-r3k-kn02 linux-headers-2.6.18-5-xen-vserver-amd64 linux-image-2.6.18-5-xen-vserver-686 linux-image-2.6.18-5-rpc linux-image-2.6.18-5-xen-686 linux-headers-2.6.18-5-vserver-s390x linux-image-2.6.18-5-parisc64-smp linux-headers-2.6.18-5-parisc64 linux-image-2.6.18-5-r4k-ip22 linux-headers-2.6.18-5 linux-headers-2.6.18-5-r5k-ip32 linux-headers-2.6.18-5-r5k-cobalt linux-headers-2.6.18-5-all-mipsel linux-headers-2.6.18-5-486 linux-headers-2.6.18-5-footbridge linux-image-2.6.18-5-vserver-powerpc64 linux-manual-2.6.18 linux-image-2.6.18-5-xen-vserver-amd64 linux-image-2.6.18-5-vserver-sparc64 linux-headers-2.6.18-5-vserver-k7 linux-headers-2.6.18-5-mckinley linux-headers-2.6.18-5-alpha-legacy linux-image-2.6.18-5-parisc-smp linux-headers-2.6.18-5-vserver linux-headers-2.6.18-5-xen linux-headers-2.6.18-5-rpc linux-modules-2.6.18-5-xen-686 linux-headers-2.6.18-5-k7 linux-image-2.6.18-5-r3k-kn02 linux-headers-2.6.18-5-qemu linux-headers-2.6.18-5-vserver-powerpc linux-headers-2.6.18-5-all-sparc linux-headers-2.6.18-5-alpha-smp linux-image-2.6.18-5-vserver-s390x linux-image-2.6.18-5-vserver-alpha linux-image-2.6.18-5-vserver-amd64 linux-headers-2.6.18-5-all-powerpc linux-headers-2.6.18-5-iop32x linux-image-2.6.18-5-footbridge linux-image-2.6.18-5-prep linux-headers-2.6.18-5-all-amd64 linux-image-2.6.18-5-powerpc64 linux-image-2.6.18-5-sb1a-bcm91480b linux-image-2.6.18-5-powerpc-smp linux-headers-2.6.18-5-all-arm linux-headers-2.6.18-5-itanium linux-headers-2.6.18-5-amd64 linux-image-2.6.18-5-powerpc-miboot xen-linux-system-2.6.18-5-xen-vserver-amd64 linux-headers-2.6.18-5-686-bigmem linux-headers-2.6.18-5-prep linux-headers-2.6.18-5-parisc-smp linux-headers-2.6.18-5-powerpc-miboot linux-headers-2.6.18-5-powerpc64 linux-image-2.6.18-5-vserver-k7 linux-headers-2.6.18-5-vserver-powerpc64 linux-image-2.6.18-5-alpha-smp linux-image-2.6.18-5-486 linux-headers-2.6.18-5-s390x linux-image-2.6.18-5-itanium linux-image-2.6.18-5-686-bigmem linux-headers-2.6.18-5-s390 linux-headers-2.6.18-5-mac linux-headers-2.6.18-5-xen-vserver-686 linux-doc-2.6.18 linux-headers-2.6.18-5-sparc64 linux-image-2.6.18-5-parisc64 linux-headers-2.6.18-5-all-i386 linux-headers-2.6.18-5-powerpc-smp linux-image-2.6.18-5-s390 linux-image-2.6.18-5-s390-tape linux-image-2.6.18-5-vserver-powerpc linux-headers-2.6.18-5-parisc linux-headers-2.6.18-5-xen-686 linux-headers-2.6.18-5-sparc64-smp linux-headers-2.6.18-5-686 linux-source-2.6.18 linux-headers-2.6.18-5-vserver-alpha linux-image-2.6.18-5-alpha-legacy linux-headers-2.6.18-5-sb1-bcm91250a linux-headers-2.6.18-5-ixp4xx linux-image-2.6.18-5-amiga linux-image-2.6.18-5-alpha-generic linux-modules-2.6.18-5-xen-vserver-686 linux-modules-2.6.18-5-xen-vserver-amd64 linux-image-2.6.18-5-r4k-kn04 linux-image-2.6.18-5-amd64 linux-headers-2.6.18-5-parisc64-smp linux-headers-2.6.18-5-powerpc linux-image-2.6.18-5-ixp4xx linux-image-2.6.18-5-parisc linux-support-2.6.18-5 linux-image-2.6.18-5-sparc64 linux-image-2.6.18-5-mac linux-headers-2.6.18-5-sparc32 linux-image-2.6.18-5-sparc64-smp linux-image-2.6.18-5-686 linux-headers-2.6.18-5-alpha-generic linux-headers-2.6.18-5-sb1a-bcm91480b linux-image-2.6.18-5-sb1-bcm91250a linux-headers-2.6.18-5-r4k-ip22 linux-image-2.6.18-5-s390x linux-patch-debian-2.6.18 xen-linux-system-2.6.18-5-xen-amd64 linux-headers-2.6.18-5-all-ia64 linux-headers-2.6.18-5-vserver-amd64 linux-headers-2.6.18-5-atari linux-image-2.6.18-5-vserver-686 linux-tree-2.6.18 linux-headers-2.6.18-5-amiga linux-image-2.6.18-5-sparc32 linux-headers-2.6.18-5-all-hppa linux-headers-2.6.18-5-s3c2410 linux-image-2.6.18-5-qemu linux-headers-2.6.18-5-r4k-kn04 linux-image-2.6.18-5-k7 linux-image-2.6.18-5-mckinley linux-headers-2.6.18-5-all linux-headers-2.6.18-5-all-mips linux-headers-2.6.18-5-vserver-sparc64 linux-modules-2.6.18-5-xen-amd64 Architecture: source sparc all Version: 2.6.18.dfsg.1-13lenny1 Distribution: testing Urgency: high Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org> Changed-By: dann frazier <[EMAIL PROTECTED]> Description: linux-doc-2.6.18 - Linux kernel specific documentation for version 2.6.18 linux-headers-2.6.18-5 - Common header files for Linux 2.6.18 linux-headers-2.6.18-5-all - All header files for Linux 2.6.18 linux-headers-2.6.18-5-all-sparc - All header files for Linux 2.6.18 linux-headers-2.6.18-5-sparc32 - Header files for Linux 2.6.18 on uniprocessor sparc32 (sun4m) linux-headers-2.6.18-5-sparc64 - Header files for Linux 2.6.18 on uniprocessor 64-bit UltraSPARC linux-headers-2.6.18-5-sparc64-smp - Header files for Linux 2.6.18 on multiprocessor 64-bit UltraSPARC linux-headers-2.6.18-5-vserver - Common header files for Linux 2.6.18 linux-headers-2.6.18-5-vserver-sparc64 - Header files for Linux 2.6.18 on uniprocessor 64-bit UltraSPARC linux-image-2.6.18-5-sparc32 - Linux 2.6.18 image on uniprocessor sparc32 (sun4m) linux-image-2.6.18-5-sparc64 - Linux 2.6.18 image on uniprocessor 64-bit UltraSPARC linux-image-2.6.18-5-sparc64-smp - Linux 2.6.18 image on multiprocessor 64-bit UltraSPARC linux-image-2.6.18-5-vserver-sparc64 - Linux 2.6.18 image on uniprocessor 64-bit UltraSPARC linux-manual-2.6.18 - Linux kernel API manual pages for version 2.6.18 linux-patch-debian-2.6.18 - Debian patches to version 2.6.18 of the Linux kernel linux-source-2.6.18 - Linux kernel source for version 2.6.18 with Debian patches linux-support-2.6.18-5 - Support files for Linux 2.6.18 linux-tree-2.6.18 - Linux kernel source tree for building Debian kernel images Closes: 404148 406111 412092 412132 412957 417629 417631 418076 418344 421281 421283 Changes: linux-2.6 (2.6.18.dfsg.1-13lenny1) testing; urgency=high . [ Bastian Blank ] * [vserver] Fix overflow in network accounting. (closes: #412132) * [vserver] Fix lock accounting. (closes: #417631) * Bump ABI to 5. * Make modules packages binnmuable. * [sparc] Enable Qlogic QLA SCSI support. (closes: #417629) . [ dann frazier ] * bugfix/listxattr-mem-corruption.patch [SECURITY] Fix userspace corruption vulnerability caused by incorrectly promoted return values in bad_inode_ops This patch changes the kernel ABI. See CVE-2006-5753 * bugfix/all/vserver/net-mount-fix.patch Fix mounting of network filesystems with VX_BINARY_MOUNT caps (closes: #418076) * Disable broken CONFIG_IP_ROUTE_MULTIPATH_CACHED setting. (closes: #418344) * bugfix/ipv6-disallow-RH0-by-default.patch [SECURITY] Avoid a remote DoS (network amplification between two routers) by disabling type0 IPv6 route headers by default. Can be re-enabled via a sysctl interface. Thanks to Vlad Yasevich for porting help. This patch changes the kernel ABI. See CVE-2007-2242 * Fix an oops which potentially results in data corruption in the gdth driver. (closes: #412092) * bugfix/amd64-make-gart-ptes-uncacheable.patch Fix silent data corruption using GART iommu (closes: #404148) . [ maximilian attems ] * Backport support for i965 to agp too. (closes: #406111) * Compile fix for UML CONFIG_MODE_TT=y. (closes: #412957) * Fix ide-generic jmicron device conflict. (closes: #421281) . [ Martin Michlmayr ] * Fix wrong checksum for split TCP packets on 64-bit MIPS. (closes: #421283) Files: 75b3eedcb9d253cb14ee6e22415a85d2 5674 devel optional linux-2.6_2.6.18.dfsg.1-13lenny1.dsc 50f9fc5a75b90e1e0194c14787b26ab8 5340591 devel optional linux-2.6_2.6.18.dfsg.1-13lenny1.diff.gz 40287b4620d6656dec80f556942dbd7d 3607830 doc optional linux-doc-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb 9ceb3cf71ac8911f1538ee798ffd00d4 1074954 doc optional linux-manual-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb 7b7e7688ce2abcda7bbb9f2b7543b9c3 1463480 devel optional linux-patch-debian-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb facab9e65a6b0697a423e8d7ea9a0b88 41417006 devel optional linux-source-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb c0f46792d9ac92fb29090750c9219813 3778224 devel optional linux-support-2.6.18-5_2.6.18.dfsg.1-13lenny1_all.deb c44840bb6e73f5c9ddd22e3c1260cf5d 50604 devel optional linux-tree-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb e69bc01913512b12c394e250a2886b09 50158 devel optional linux-headers-2.6.18-5-all_2.6.18.dfsg.1-13lenny1_sparc.deb 405fba716c6668c1c270e3927b368d49 50184 devel optional linux-headers-2.6.18-5-all-sparc_2.6.18.dfsg.1-13lenny1_sparc.deb 0335b2e1f02717173615c404643557a0 3163976 devel optional linux-headers-2.6.18-5_2.6.18.dfsg.1-13lenny1_sparc.deb 57dbdfef212c4615f25899619d677009 6405798 admin optional linux-image-2.6.18-5-sparc32_2.6.18.dfsg.1-13lenny1_sparc.deb 488f882e0f5fa2a6f2c48729b6940a0f 161350 devel optional linux-headers-2.6.18-5-sparc32_2.6.18.dfsg.1-13lenny1_sparc.deb 8908e58175418d49878e124867f295f0 10349990 admin optional linux-image-2.6.18-5-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb 2c9ac125555eb765e9ac375c42837df3 190578 devel optional linux-headers-2.6.18-5-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb fc18cd6f7d253abc261c2dae3ed4ca69 10610136 admin optional linux-image-2.6.18-5-sparc64-smp_2.6.18.dfsg.1-13lenny1_sparc.deb 9db2ee3fd2255dff61e678a13c618542 191332 devel optional linux-headers-2.6.18-5-sparc64-smp_2.6.18.dfsg.1-13lenny1_sparc.deb 867dba2493174c01845d3cdb3cd72d08 3186426 devel optional linux-headers-2.6.18-5-vserver_2.6.18.dfsg.1-13lenny1_sparc.deb 28fcbe57e864862729eac4f2a0f1073d 10656456 admin optional linux-image-2.6.18-5-vserver-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb 5b6ef42a31830a8629bcd1902be494d3 191748 devel optional linux-headers-2.6.18-5-vserver-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFGVKF/huANDBmkLRkRArIfAJ9fqjosutZ4/1wMHF7i3ryC5ylJagCfVYgm da1GVhG5unx1JV5h0WovvBs= =S1AY -----END PGP SIGNATURE-----
--- End Message ---
