Your message dated Thu, 24 May 2007 21:27:01 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#421283: fixed in linux-2.6 2.6.18.dfsg.1-13lenny1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
Package: linux-2.6
This is needed for our 2.6.18 kernel in etch.
----- Forwarded message from Dave Johnson <[EMAIL PROTECTED]> -----
From: Dave Johnson <[EMAIL PROTECTED]>
Subject: [PATCH] Fix wrong checksum for split TCP packets on 64-bit MIPS
Date: Wed, 18 Apr 2007 10:39:41 -0400
To: [EMAIL PROTECTED], Ralf Baechle <[EMAIL PROTECTED]>
X-Mailer: VM 7.17 under 21.4 (patch 17) "Jumbo Shrimp" XEmacs Lucid
I've traced down an off-by-one TCP checksum calculation error under
the following conditions:
1) The TCP code needs to split a full-sized packet due to a reduced
MSS (typically due to the addition of TCP options mid-stream like
SACK).
_AND_
2) The checksum of the 2nd fragment is larger than the checksum of the
original packet. After subtraction this results in a checksum for
the 1st fragment with bits 16..31 set to 1. (this is ok)
_AND_
3) The checksum of the 1st fragment's TCP header plus the previously
32bit checksum of the 1st fragment DOES NOT cause a 32bit overflow
when added together. This results in a checksum of the TCP header
plus TCP data that still has the upper 16 bits as 1's.
_THEN_
4) The TCP+data checksum is added to the checksum of the pseudo IP
header with csum_tcpudp_nofold() incorrectly (the bug).
The problem is the checksum of the TCP+data is passed to
csum_tcpudp_nofold() as an 32bit unsigned value, however the assembly
code acts on it as if it is a 64bit unsigned value.
This causes an incorrect 32->64bit extension if the sum has bit 31
set. The resulting checksum is off by one.
This problems is data and TCP header dependent due to #2 and #3
above so it doesn't occur on every TCP packet split.
Patch below is against 2.6.20, however this problem looks like it's
been around since at least Aug 2003 when the 64bit ASM was added to
csum_tcpudp_nofold().
Signed-off-by: Dave Johnson <[EMAIL PROTECTED]>
--- old/include/asm-mips/checksum.h 2007-01-24 14:23:22 -05:00
+++ new/include/asm-mips/checksum.h 2007-04-18 10:31:27 -04:00
@@ -166,7 +166,7 @@
#else
"r" (proto + len),
#endif
- "r" (sum));
+ "r" ((__force unsigned long)sum));
return sum;
}
----- End forwarded message -----
----- Forwarded message from Ralf Baechle <[EMAIL PROTECTED]> -----
From: Ralf Baechle <[EMAIL PROTECTED]>
Subject: Re: [PATCH] Fix wrong checksum for split TCP packets on 64-bit MIPS
Date: Wed, 18 Apr 2007 17:17:07 +0100
To: Dave Johnson <[EMAIL PROTECTED]>
Cc: [EMAIL PROTECTED]
User-Agent: Mutt/1.4.2.2i
On Wed, Apr 18, 2007 at 10:39:41AM -0400, Dave Johnson wrote:
> the following conditions:
>
> 1) The TCP code needs to split a full-sized packet due to a reduced
> MSS (typically due to the addition of TCP options mid-stream like
> SACK).
> _AND_
> 2) The checksum of the 2nd fragment is larger than the checksum of the
> original packet. After subtraction this results in a checksum for
> the 1st fragment with bits 16..31 set to 1. (this is ok)
> _AND_
> 3) The checksum of the 1st fragment's TCP header plus the previously
> 32bit checksum of the 1st fragment DOES NOT cause a 32bit overflow
> when added together. This results in a checksum of the TCP header
> plus TCP data that still has the upper 16 bits as 1's.
> _THEN_
> 4) The TCP+data checksum is added to the checksum of the pseudo IP
> header with csum_tcpudp_nofold() incorrectly (the bug).
>
> The problem is the checksum of the TCP+data is passed to
> csum_tcpudp_nofold() as an 32bit unsigned value, however the assembly
> code acts on it as if it is a 64bit unsigned value.
>
> This causes an incorrect 32->64bit extension if the sum has bit 31
> set. The resulting checksum is off by one.
Sigh. The second bug of this kind. As clever and apparently elegent as
the sign extension stuff happens to look on MIPS as prone to unobvious
accidents it is at times. Oh well.
Applied & thanks!
Ralf
----- End forwarded message -----
--
Martin Michlmayr
http://www.cyrius.com/
--- End Message ---
--- Begin Message ---
Source: linux-2.6
Source-Version: 2.6.18.dfsg.1-13lenny1
We believe that the bug you reported is fixed in the latest version of
linux-2.6, which is due to be installed in the Debian FTP archive:
linux-2.6_2.6.18.dfsg.1-13lenny1.diff.gz
to pool/main/l/linux-2.6/linux-2.6_2.6.18.dfsg.1-13lenny1.diff.gz
linux-2.6_2.6.18.dfsg.1-13lenny1.dsc
to pool/main/l/linux-2.6/linux-2.6_2.6.18.dfsg.1-13lenny1.dsc
linux-doc-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
to pool/main/l/linux-2.6/linux-doc-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
linux-headers-2.6.18-5-all-sparc_2.6.18.dfsg.1-13lenny1_sparc.deb
to
pool/main/l/linux-2.6/linux-headers-2.6.18-5-all-sparc_2.6.18.dfsg.1-13lenny1_sparc.deb
linux-headers-2.6.18-5-all_2.6.18.dfsg.1-13lenny1_sparc.deb
to
pool/main/l/linux-2.6/linux-headers-2.6.18-5-all_2.6.18.dfsg.1-13lenny1_sparc.deb
linux-headers-2.6.18-5-sparc32_2.6.18.dfsg.1-13lenny1_sparc.deb
to
pool/main/l/linux-2.6/linux-headers-2.6.18-5-sparc32_2.6.18.dfsg.1-13lenny1_sparc.deb
linux-headers-2.6.18-5-sparc64-smp_2.6.18.dfsg.1-13lenny1_sparc.deb
to
pool/main/l/linux-2.6/linux-headers-2.6.18-5-sparc64-smp_2.6.18.dfsg.1-13lenny1_sparc.deb
linux-headers-2.6.18-5-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb
to
pool/main/l/linux-2.6/linux-headers-2.6.18-5-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb
linux-headers-2.6.18-5-vserver-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb
to
pool/main/l/linux-2.6/linux-headers-2.6.18-5-vserver-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb
linux-headers-2.6.18-5-vserver_2.6.18.dfsg.1-13lenny1_sparc.deb
to
pool/main/l/linux-2.6/linux-headers-2.6.18-5-vserver_2.6.18.dfsg.1-13lenny1_sparc.deb
linux-headers-2.6.18-5_2.6.18.dfsg.1-13lenny1_sparc.deb
to
pool/main/l/linux-2.6/linux-headers-2.6.18-5_2.6.18.dfsg.1-13lenny1_sparc.deb
linux-image-2.6.18-5-sparc32_2.6.18.dfsg.1-13lenny1_sparc.deb
to
pool/main/l/linux-2.6/linux-image-2.6.18-5-sparc32_2.6.18.dfsg.1-13lenny1_sparc.deb
linux-image-2.6.18-5-sparc64-smp_2.6.18.dfsg.1-13lenny1_sparc.deb
to
pool/main/l/linux-2.6/linux-image-2.6.18-5-sparc64-smp_2.6.18.dfsg.1-13lenny1_sparc.deb
linux-image-2.6.18-5-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb
to
pool/main/l/linux-2.6/linux-image-2.6.18-5-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb
linux-image-2.6.18-5-vserver-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb
to
pool/main/l/linux-2.6/linux-image-2.6.18-5-vserver-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb
linux-manual-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
to pool/main/l/linux-2.6/linux-manual-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
linux-patch-debian-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
to
pool/main/l/linux-2.6/linux-patch-debian-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
linux-source-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
to pool/main/l/linux-2.6/linux-source-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
linux-support-2.6.18-5_2.6.18.dfsg.1-13lenny1_all.deb
to pool/main/l/linux-2.6/linux-support-2.6.18-5_2.6.18.dfsg.1-13lenny1_all.deb
linux-tree-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
to pool/main/l/linux-2.6/linux-tree-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
dann frazier <[EMAIL PROTECTED]> (supplier of updated linux-2.6 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Mon, 21 May 2007 14:45:13 -0600
Source: linux-2.6
Binary: linux-image-2.6.18-5-s3c2410 linux-headers-2.6.18-5-all-s390
linux-headers-2.6.18-5-all-m68k linux-headers-2.6.18-5-xen-amd64
linux-image-2.6.18-5-iop32x linux-headers-2.6.18-5-all-alpha
linux-image-2.6.18-5-r5k-cobalt linux-image-2.6.18-5-r5k-ip32
linux-headers-2.6.18-5-vserver-686 linux-headers-2.6.18-5-xen-vserver
xen-linux-system-2.6.18-5-xen-686 linux-image-2.6.18-5-xen-amd64
linux-image-2.6.18-5-powerpc xen-linux-system-2.6.18-5-xen-vserver-686
linux-image-2.6.18-5-atari linux-headers-2.6.18-5-r3k-kn02
linux-headers-2.6.18-5-xen-vserver-amd64 linux-image-2.6.18-5-xen-vserver-686
linux-image-2.6.18-5-rpc linux-image-2.6.18-5-xen-686
linux-headers-2.6.18-5-vserver-s390x linux-image-2.6.18-5-parisc64-smp
linux-headers-2.6.18-5-parisc64 linux-image-2.6.18-5-r4k-ip22
linux-headers-2.6.18-5 linux-headers-2.6.18-5-r5k-ip32
linux-headers-2.6.18-5-r5k-cobalt linux-headers-2.6.18-5-all-mipsel
linux-headers-2.6.18-5-486 linux-headers-2.6.18-5-footbridge
linux-image-2.6.18-5-vserver-powerpc64 linux-manual-2.6.18
linux-image-2.6.18-5-xen-vserver-amd64 linux-image-2.6.18-5-vserver-sparc64
linux-headers-2.6.18-5-vserver-k7 linux-headers-2.6.18-5-mckinley
linux-headers-2.6.18-5-alpha-legacy linux-image-2.6.18-5-parisc-smp
linux-headers-2.6.18-5-vserver linux-headers-2.6.18-5-xen
linux-headers-2.6.18-5-rpc linux-modules-2.6.18-5-xen-686
linux-headers-2.6.18-5-k7 linux-image-2.6.18-5-r3k-kn02
linux-headers-2.6.18-5-qemu linux-headers-2.6.18-5-vserver-powerpc
linux-headers-2.6.18-5-all-sparc linux-headers-2.6.18-5-alpha-smp
linux-image-2.6.18-5-vserver-s390x linux-image-2.6.18-5-vserver-alpha
linux-image-2.6.18-5-vserver-amd64 linux-headers-2.6.18-5-all-powerpc
linux-headers-2.6.18-5-iop32x linux-image-2.6.18-5-footbridge
linux-image-2.6.18-5-prep linux-headers-2.6.18-5-all-amd64
linux-image-2.6.18-5-powerpc64 linux-image-2.6.18-5-sb1a-bcm91480b
linux-image-2.6.18-5-powerpc-smp linux-headers-2.6.18-5-all-arm
linux-headers-2.6.18-5-itanium linux-headers-2.6.18-5-amd64
linux-image-2.6.18-5-powerpc-miboot xen-linux-system-2.6.18-5-xen-vserver-amd64
linux-headers-2.6.18-5-686-bigmem linux-headers-2.6.18-5-prep
linux-headers-2.6.18-5-parisc-smp linux-headers-2.6.18-5-powerpc-miboot
linux-headers-2.6.18-5-powerpc64 linux-image-2.6.18-5-vserver-k7
linux-headers-2.6.18-5-vserver-powerpc64 linux-image-2.6.18-5-alpha-smp
linux-image-2.6.18-5-486 linux-headers-2.6.18-5-s390x
linux-image-2.6.18-5-itanium linux-image-2.6.18-5-686-bigmem
linux-headers-2.6.18-5-s390 linux-headers-2.6.18-5-mac
linux-headers-2.6.18-5-xen-vserver-686 linux-doc-2.6.18
linux-headers-2.6.18-5-sparc64 linux-image-2.6.18-5-parisc64
linux-headers-2.6.18-5-all-i386 linux-headers-2.6.18-5-powerpc-smp
linux-image-2.6.18-5-s390 linux-image-2.6.18-5-s390-tape
linux-image-2.6.18-5-vserver-powerpc linux-headers-2.6.18-5-parisc
linux-headers-2.6.18-5-xen-686 linux-headers-2.6.18-5-sparc64-smp
linux-headers-2.6.18-5-686 linux-source-2.6.18
linux-headers-2.6.18-5-vserver-alpha linux-image-2.6.18-5-alpha-legacy
linux-headers-2.6.18-5-sb1-bcm91250a linux-headers-2.6.18-5-ixp4xx
linux-image-2.6.18-5-amiga linux-image-2.6.18-5-alpha-generic
linux-modules-2.6.18-5-xen-vserver-686 linux-modules-2.6.18-5-xen-vserver-amd64
linux-image-2.6.18-5-r4k-kn04 linux-image-2.6.18-5-amd64
linux-headers-2.6.18-5-parisc64-smp linux-headers-2.6.18-5-powerpc
linux-image-2.6.18-5-ixp4xx linux-image-2.6.18-5-parisc linux-support-2.6.18-5
linux-image-2.6.18-5-sparc64 linux-image-2.6.18-5-mac
linux-headers-2.6.18-5-sparc32 linux-image-2.6.18-5-sparc64-smp
linux-image-2.6.18-5-686 linux-headers-2.6.18-5-alpha-generic
linux-headers-2.6.18-5-sb1a-bcm91480b linux-image-2.6.18-5-sb1-bcm91250a
linux-headers-2.6.18-5-r4k-ip22 linux-image-2.6.18-5-s390x
linux-patch-debian-2.6.18 xen-linux-system-2.6.18-5-xen-amd64
linux-headers-2.6.18-5-all-ia64 linux-headers-2.6.18-5-vserver-amd64
linux-headers-2.6.18-5-atari linux-image-2.6.18-5-vserver-686 linux-tree-2.6.18
linux-headers-2.6.18-5-amiga linux-image-2.6.18-5-sparc32
linux-headers-2.6.18-5-all-hppa linux-headers-2.6.18-5-s3c2410
linux-image-2.6.18-5-qemu linux-headers-2.6.18-5-r4k-kn04
linux-image-2.6.18-5-k7 linux-image-2.6.18-5-mckinley
linux-headers-2.6.18-5-all linux-headers-2.6.18-5-all-mips
linux-headers-2.6.18-5-vserver-sparc64 linux-modules-2.6.18-5-xen-amd64
Architecture: source sparc all
Version: 2.6.18.dfsg.1-13lenny1
Distribution: testing
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: dann frazier <[EMAIL PROTECTED]>
Description:
linux-doc-2.6.18 - Linux kernel specific documentation for version 2.6.18
linux-headers-2.6.18-5 - Common header files for Linux 2.6.18
linux-headers-2.6.18-5-all - All header files for Linux 2.6.18
linux-headers-2.6.18-5-all-sparc - All header files for Linux 2.6.18
linux-headers-2.6.18-5-sparc32 - Header files for Linux 2.6.18 on uniprocessor
sparc32 (sun4m)
linux-headers-2.6.18-5-sparc64 - Header files for Linux 2.6.18 on uniprocessor
64-bit UltraSPARC
linux-headers-2.6.18-5-sparc64-smp - Header files for Linux 2.6.18 on
multiprocessor 64-bit UltraSPARC
linux-headers-2.6.18-5-vserver - Common header files for Linux 2.6.18
linux-headers-2.6.18-5-vserver-sparc64 - Header files for Linux 2.6.18 on
uniprocessor 64-bit UltraSPARC
linux-image-2.6.18-5-sparc32 - Linux 2.6.18 image on uniprocessor sparc32
(sun4m)
linux-image-2.6.18-5-sparc64 - Linux 2.6.18 image on uniprocessor 64-bit
UltraSPARC
linux-image-2.6.18-5-sparc64-smp - Linux 2.6.18 image on multiprocessor 64-bit
UltraSPARC
linux-image-2.6.18-5-vserver-sparc64 - Linux 2.6.18 image on uniprocessor
64-bit UltraSPARC
linux-manual-2.6.18 - Linux kernel API manual pages for version 2.6.18
linux-patch-debian-2.6.18 - Debian patches to version 2.6.18 of the Linux
kernel
linux-source-2.6.18 - Linux kernel source for version 2.6.18 with Debian
patches
linux-support-2.6.18-5 - Support files for Linux 2.6.18
linux-tree-2.6.18 - Linux kernel source tree for building Debian kernel images
Closes: 404148 406111 412092 412132 412957 417629 417631 418076 418344 421281
421283
Changes:
linux-2.6 (2.6.18.dfsg.1-13lenny1) testing; urgency=high
.
[ Bastian Blank ]
* [vserver] Fix overflow in network accounting. (closes: #412132)
* [vserver] Fix lock accounting. (closes: #417631)
* Bump ABI to 5.
* Make modules packages binnmuable.
* [sparc] Enable Qlogic QLA SCSI support. (closes: #417629)
.
[ dann frazier ]
* bugfix/listxattr-mem-corruption.patch
[SECURITY] Fix userspace corruption vulnerability caused by
incorrectly promoted return values in bad_inode_ops
This patch changes the kernel ABI.
See CVE-2006-5753
* bugfix/all/vserver/net-mount-fix.patch
Fix mounting of network filesystems with VX_BINARY_MOUNT caps
(closes: #418076)
* Disable broken CONFIG_IP_ROUTE_MULTIPATH_CACHED setting. (closes: #418344)
* bugfix/ipv6-disallow-RH0-by-default.patch
[SECURITY] Avoid a remote DoS (network amplification between two routers)
by disabling type0 IPv6 route headers by default. Can be re-enabled via
a sysctl interface. Thanks to Vlad Yasevich for porting help.
This patch changes the kernel ABI.
See CVE-2007-2242
* Fix an oops which potentially results in data corruption in the gdth
driver.
(closes: #412092)
* bugfix/amd64-make-gart-ptes-uncacheable.patch
Fix silent data corruption using GART iommu (closes: #404148)
.
[ maximilian attems ]
* Backport support for i965 to agp too. (closes: #406111)
* Compile fix for UML CONFIG_MODE_TT=y. (closes: #412957)
* Fix ide-generic jmicron device conflict. (closes: #421281)
.
[ Martin Michlmayr ]
* Fix wrong checksum for split TCP packets on 64-bit MIPS. (closes: #421283)
Files:
75b3eedcb9d253cb14ee6e22415a85d2 5674 devel optional
linux-2.6_2.6.18.dfsg.1-13lenny1.dsc
50f9fc5a75b90e1e0194c14787b26ab8 5340591 devel optional
linux-2.6_2.6.18.dfsg.1-13lenny1.diff.gz
40287b4620d6656dec80f556942dbd7d 3607830 doc optional
linux-doc-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
9ceb3cf71ac8911f1538ee798ffd00d4 1074954 doc optional
linux-manual-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
7b7e7688ce2abcda7bbb9f2b7543b9c3 1463480 devel optional
linux-patch-debian-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
facab9e65a6b0697a423e8d7ea9a0b88 41417006 devel optional
linux-source-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
c0f46792d9ac92fb29090750c9219813 3778224 devel optional
linux-support-2.6.18-5_2.6.18.dfsg.1-13lenny1_all.deb
c44840bb6e73f5c9ddd22e3c1260cf5d 50604 devel optional
linux-tree-2.6.18_2.6.18.dfsg.1-13lenny1_all.deb
e69bc01913512b12c394e250a2886b09 50158 devel optional
linux-headers-2.6.18-5-all_2.6.18.dfsg.1-13lenny1_sparc.deb
405fba716c6668c1c270e3927b368d49 50184 devel optional
linux-headers-2.6.18-5-all-sparc_2.6.18.dfsg.1-13lenny1_sparc.deb
0335b2e1f02717173615c404643557a0 3163976 devel optional
linux-headers-2.6.18-5_2.6.18.dfsg.1-13lenny1_sparc.deb
57dbdfef212c4615f25899619d677009 6405798 admin optional
linux-image-2.6.18-5-sparc32_2.6.18.dfsg.1-13lenny1_sparc.deb
488f882e0f5fa2a6f2c48729b6940a0f 161350 devel optional
linux-headers-2.6.18-5-sparc32_2.6.18.dfsg.1-13lenny1_sparc.deb
8908e58175418d49878e124867f295f0 10349990 admin optional
linux-image-2.6.18-5-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb
2c9ac125555eb765e9ac375c42837df3 190578 devel optional
linux-headers-2.6.18-5-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb
fc18cd6f7d253abc261c2dae3ed4ca69 10610136 admin optional
linux-image-2.6.18-5-sparc64-smp_2.6.18.dfsg.1-13lenny1_sparc.deb
9db2ee3fd2255dff61e678a13c618542 191332 devel optional
linux-headers-2.6.18-5-sparc64-smp_2.6.18.dfsg.1-13lenny1_sparc.deb
867dba2493174c01845d3cdb3cd72d08 3186426 devel optional
linux-headers-2.6.18-5-vserver_2.6.18.dfsg.1-13lenny1_sparc.deb
28fcbe57e864862729eac4f2a0f1073d 10656456 admin optional
linux-image-2.6.18-5-vserver-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb
5b6ef42a31830a8629bcd1902be494d3 191748 devel optional
linux-headers-2.6.18-5-vserver-sparc64_2.6.18.dfsg.1-13lenny1_sparc.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFGVKF/huANDBmkLRkRArIfAJ9fqjosutZ4/1wMHF7i3ryC5ylJagCfVYgm
da1GVhG5unx1JV5h0WovvBs=
=S1AY
-----END PGP SIGNATURE-----
--- End Message ---