rpms/kernel/F-12 ethtool-fix-buffer-overflow.patch, NONE, 1.1 sched-fix-over-scheduling-bug.patch, NONE, 1.1 kernel.spec, 1.2101, 1.2102

[Chuck Ebbert]

Author: cebbert

Update of /cvs/pkgs/rpms/kernel/F-12
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv17589

Modified Files:
	kernel.spec 
Added Files:
	ethtool-fix-buffer-overflow.patch 
	sched-fix-over-scheduling-bug.patch 
Log Message:
ethtool-fix-buffer-overflow.patch: ethtool buffer overflow (CVE-2010-2478)
sched-fix-over-scheduling-bug.patch: fix scheduler bug with CGROUPS

ethtool-fix-buffer-overflow.patch:
 ethtool.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- NEW FILE ethtool-fix-buffer-overflow.patch ---
From: Ben Hutchings <bhutchings at solarflare.com>
Date: Mon, 28 Jun 2010 08:44:07 +0000 (+0000)
Subject: ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fdavem%2Fnet-2.6.git;a=commitdiff_plain;h=db048b69037e7fa6a7d9e95a1271a50dc08ae233

ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL

On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer
overflow and the buffer may be smaller than needed.  Since
ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at
least denial of service.

Signed-off-by: Ben Hutchings <bhutchings at solarflare.com>
Cc: stable at kernel.org
Signed-off-by: David S. Miller <davem at davemloft.net>
---

diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index a0f4964..a3a7e9a 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -347,8 +347,9 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
 
 	if (info.cmd == ETHTOOL_GRXCLSRLALL) {
 		if (info.rule_cnt > 0) {
-			rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
-					   GFP_USER);
+			if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
+				rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+						   GFP_USER);
 			if (!rule_buf)
 				return -ENOMEM;
 		}

sched-fix-over-scheduling-bug.patch:
 sched.c |    3 ---
 1 file changed, 3 deletions(-)

--- NEW FILE sched-fix-over-scheduling-bug.patch ---
From: Alex,Shi <alex.shi at intel.com>
Date: Thu, 17 Jun 2010 06:08:13 +0000 (+0800)
Subject: sched: Fix over-scheduling bug
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=3c93717cfa51316e4dbb471e7c0f9d243359d5f8

sched: Fix over-scheduling bug

Commit e70971591 ("sched: Optimize unused cgroup configuration") introduced
an imbalanced scheduling bug.  [[ in 2.6.32-rc1 ]]

If we do not use CGROUP, function update_h_load won't update h_load. When the
system has a large number of tasks far more than logical CPU number, the
incorrect cfs_rq[cpu]->h_load value will cause load_balance() to pull too
many tasks to the local CPU from the busiest CPU. So the busiest CPU keeps
going in a round robin. That will hurt performance.

The issue was found originally by a scientific calculation workload that
developed by Yanmin. With that commit, the workload performance drops
about 40%.

 CPU  before    after

 00   : 2       : 7
 01   : 1       : 7
 02   : 11      : 6
 03   : 12      : 7
 04   : 6       : 6
 05   : 11      : 7
 06   : 10      : 6
 07   : 12      : 7
 08   : 11      : 6
 09   : 12      : 6
 10   : 1       : 6
 11   : 1       : 6
 12   : 6       : 6
 13   : 2       : 6
 14   : 2       : 6
 15   : 1       : 6

Reviewed-by: Yanmin zhang <yanmin.zhang at intel.com>
Signed-off-by: Alex Shi <alex.shi at intel.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
LKML-Reference: <1276754893.9452.5442.camel at debian>
Signed-off-by: Ingo Molnar <mingo at elte.hu>
---

diff --git a/kernel/sched.c b/kernel/sched.c
index 2aaceeb..6c9e7c8 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -1657,9 +1657,6 @@ static void update_shares(struct sched_domain *sd)
 
 static void update_h_load(long cpu)
 {
-	if (root_task_group_empty())
-		return;
-
 	walk_tg_tree(tg_load_down, tg_nop, (void *)cpu);
 }
 


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-12/kernel.spec,v
retrieving revision 1.2101
retrieving revision 1.2102
diff -u -p -r1.2101 -r1.2102
--- kernel.spec	6 Jul 2010 08:24:23 -0000	1.2101
+++ kernel.spec	7 Jul 2010 03:41:22 -0000	1.2102
@@ -835,6 +835,9 @@ Patch13020: iwlwifi-cancel-scan-watchdog
 # l2tp: fix oops in pppol2tp_xmit (#607054)
 Patch13030: l2tp-fix-oops-in-pppol2tp_xmit.patch
 
+Patch14000: sched-fix-over-scheduling-bug.patch
+Patch14010: ethtool-fix-buffer-overflow.patch
+
 # ==============================================================================
 %endif
 
@@ -1521,6 +1524,12 @@ ApplyPatch iwlwifi-cancel-scan-watchdog-
 # l2tp: fix oops in pppol2tp_xmit (#607054)
 ApplyPatch l2tp-fix-oops-in-pppol2tp_xmit.patch
 
+# fix performance problem with CGROUPS
+ApplyPatch sched-fix-over-scheduling-bug.patch
+
+# CVE-2010-2478
+ApplyPatch ethtool-fix-buffer-overflow.patch
+
 # END OF PATCH APPLICATIONS ====================================================
 %endif
 
@@ -2170,6 +2179,10 @@ fi
 %kernel_variant_files -k vmlinux %{with_kdump} kdump
 
 %changelog
+* Tue Jul 06 2010 Chuck Ebbert <cebbert at redhat.com> 2.6.32.16-140
+- ethtool-fix-buffer-overflow.patch: ethtool buffer overflow (CVE-2010-2478)
+- sched-fix-over-scheduling-bug.patch: fix scheduler bug with CGROUPS
+
 * Tue Jul 06 2010 Chuck Ebbert <cebbert at redhat.com>  2.6.32.16-139
 - Linux 2.6.32.16