From mboxrd@z Thu Jan 1 00:00:00 1970 From: git@ipfire.org To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, core104, updated. 69f3684cf5337d34963b1ee6a5c8ac2072c6eaf6 Date: Mon, 22 Aug 2016 06:26:11 +0100 Message-ID: <20160822052611.C93371078E81@git01.ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7122110172228115556==" List-Id: --===============7122110172228115556== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core104 has been updated via 69f3684cf5337d34963b1ee6a5c8ac2072c6eaf6 (commit) from 66cb9ec42bba14237972f3e7e4532eb1d936100d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 69f3684cf5337d34963b1ee6a5c8ac2072c6eaf6 Author: Arne Fitzenreiter Date: Sun Aug 21 22:40:12 2016 +0200 kernel: fix grsecurity patch. =20 Signed-off-by: Arne Fitzenreiter ----------------------------------------------------------------------- Summary of changes: lfs/linux | 1 + .../linux-3.14.77-gsrec_tcp_input_access_once_rw.patch | 18 ++++++++++++++++= ++ 2 files changed, 19 insertions(+) create mode 100644 src/patches/linux-3.14.77-gsrec_tcp_input_access_once_rw.= patch Difference in files: diff --git a/lfs/linux b/lfs/linux index 5c37a4b..e365be6 100644 --- a/lfs/linux +++ b/lfs/linux @@ -132,6 +132,7 @@ ifneq "$(KCFG)" "-headers" cd $(DIR_APP) && xz -c -d $(DIR_DL)/$(GRS_PATCHES) | patch -Np1 cd $(DIR_APP) && rm localversion-grsec cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.7-disable-comp= at_vdso.patch + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-3.14.77-gsrec_tc= p_input_access_once_rw.patch endif =20 # DVB Patches diff --git a/src/patches/linux-3.14.77-gsrec_tcp_input_access_once_rw.patch b= /src/patches/linux-3.14.77-gsrec_tcp_input_access_once_rw.patch new file mode 100644 index 0000000..19d0448 --- /dev/null +++ b/src/patches/linux-3.14.77-gsrec_tcp_input_access_once_rw.patch @@ -0,0 +1,18 @@ +diff -Naur linux-3.14.77.org/net/ipv4/tcp_input.c linux-3.14.77/net/ipv4/tcp= _input.c +--- linux-3.14.77.org/net/ipv4/tcp_input.c 2016-08-21 19:58:45.000000000 +02= 00 ++++ linux-3.14.77/net/ipv4/tcp_input.c 2016-08-21 21:11:24.336757369 +0200 +@@ -3299,12 +3299,12 @@ + u32 half =3D (sysctl_tcp_challenge_ack_limit + 1) >> 1; +=20 + challenge_timestamp =3D now; +- ACCESS_ONCE(challenge_count) =3D half + ++ ACCESS_ONCE_RW(challenge_count) =3D half + + prandom_u32_max(sysctl_tcp_challenge_ack_limit); + } + count =3D ACCESS_ONCE(challenge_count); + if (count > 0) { +- ACCESS_ONCE(challenge_count) =3D count - 1; ++ ACCESS_ONCE_RW(challenge_count) =3D count - 1; + NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK); + tcp_send_ack(sk); + } hooks/post-receive -- IPFire 2.x development tree --===============7122110172228115556==--