lp:~ubuntu-kernel/ubuntu/+source/linux/+git/karmic

Author: Dan Rosenberg
Author Date: 2010-12-22 13:58:27 UTC

irda: prevent integer underflow in IRLMP_ENUMDEVICES, CVE-2010-4529

CVE-2010-4529

BugLink: http://bugs.launchpad.net/bugs/737823

If the user-provided len is less than the expected offset, the
IRLMP_ENUMDEVICES getsockopt will do a copy_to_user() with a very large
size value. While this isn't be a security issue on x86 because it will
get caught by the access_ok() check, it may leak large amounts of kernel
heap on other architectures. In any event, this patch fixes it.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(backport of upstream commit fdac1e0697356ac212259f2147aa60c72e334861)

Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>

Author: Brad Figg
Author Date: 2011-03-18 19:01:08 UTC

UBUNTU: Ubuntu-2.6.31-308.29

Signed-off-by: Brad Figg <brad.figg@canonical.com>

Author: Brad Figg
Author Date: 2011-03-18 16:54:28 UTC

UBUNTU: Ubuntu-2.6.31-23.75

Signed-off-by: Brad Figg <brad.figg@canonical.com>

Author: Tim Gardner
Author Date: 2011-02-04 15:00:22 UTC

UBUNTU: Ubuntu-2.6.31-112.30

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

Author: Brad Figg
Author Date: 2011-01-06 19:38:35 UTC

UBUNTU: Ubuntu-2.6.31-214.33

Signed-off-by: Brad Figg <brad.figg@canonical.com>

Author: Tim Gardner
Author Date: 2009-08-11 12:50:40 UTC

Refreshed DSDT patch

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

Author: Tim Gardner
Author Date: 2009-04-28 23:05:36 UTC

0001-mpt2sas-Change-reset_type-enum-to-avoid-namespace-c.patch
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>