This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree".

The branch, core104 has been updated via 69f3684cf5337d34963b1ee6a5c8ac2072c6eaf6 (commit) from 66cb9ec42bba14237972f3e7e4532eb1d936100d (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- commit 69f3684cf5337d34963b1ee6a5c8ac2072c6eaf6 Author: Arne Fitzenreiter arne_f@ipfire.org Date: Sun Aug 21 22:40:12 2016 +0200

kernel: fix grsecurity patch.

Signed-off-by: Arne Fitzenreiter arne_f@ipfire.org

-----------------------------------------------------------------------

Summary of changes: lfs/linux | 1 + .../linux-3.14.77-gsrec_tcp_input_access_once_rw.patch | 18 ++++++++++++++++++ 2 files changed, 19 insertions(+) create mode 100644 src/patches/linux-3.14.77-gsrec_tcp_input_access_once_rw.patch

Difference in files: diff --git a/lfs/linux b/lfs/linux index 5c37a4b..e365be6 100644 --- a/lfs/linux +++ b/lfs/linux @@ -132,6 +132,7 @@ ifneq "$(KCFG)" "-headers" cd $(DIR_APP) && xz -c -d $(DIR_DL)/$(GRS_PATCHES) | patch -Np1 cd $(DIR_APP) && rm localversion-grsec cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.7-disable-compat_vdso.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.14.77-gsrec_tcp_input_access_once_rw.patch endif

# DVB Patches diff --git a/src/patches/linux-3.14.77-gsrec_tcp_input_access_once_rw.patch b/src/patches/linux-3.14.77-gsrec_tcp_input_access_once_rw.patch new file mode 100644 index 0000000..19d0448 --- /dev/null +++ b/src/patches/linux-3.14.77-gsrec_tcp_input_access_once_rw.patch @@ -0,0 +1,18 @@ +diff -Naur linux-3.14.77.org/net/ipv4/tcp_input.c linux-3.14.77/net/ipv4/tcp_input.c +--- linux-3.14.77.org/net/ipv4/tcp_input.c 2016-08-21 19:58:45.000000000 +0200 ++++ linux-3.14.77/net/ipv4/tcp_input.c 2016-08-21 21:11:24.336757369 +0200 +@@ -3299,12 +3299,12 @@ + u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1; + + challenge_timestamp = now; +- ACCESS_ONCE(challenge_count) = half + ++ ACCESS_ONCE_RW(challenge_count) = half + + prandom_u32_max(sysctl_tcp_challenge_ack_limit); + } + count = ACCESS_ONCE(challenge_count); + if (count > 0) { +- ACCESS_ONCE(challenge_count) = count - 1; ++ ACCESS_ONCE_RW(challenge_count) = count - 1; + NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK); + tcp_send_ack(sk); + }

hooks/post-receive -- IPFire 2.x development tree