Bug 733986

Summary: kernel: regression in CVE-2011-1768 fix [mrg-2.1]
Product: Red Hat Enterprise MRG Reporter: Eugene Teo (Security Response) <eteo>
Component: realtime-kernelAssignee: Red Hat Real Time Maintenance <rt-maint>
Status: CLOSED NOTABUG QA Contact: David Sommerseth <davids>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 2.0CC: bhu, davids, eteo, herbert.xu, jbenc, jkacur, lgoncalv, ovasik, tgraf, williams
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 733985 Environment:
Last Closed: 2011-10-03 04:03:14 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 733985    
Bug Blocks:    

Description Eugene Teo (Security Response) 2011-08-29 04:46:20 UTC 
+++ This bug was initially created as a clone of Bug #733985 +++

Description of problem:
The upstream commit d5aa407f59f5b83d2c50ec88f5bf56d40f1f8978 ("tunnels: fix
netns vs proto registration ordering") was not backported correctly, and results in a NULL pointer dereference in ip6_tunnel.c.

https://bugs.gentoo.org/show_bug.cgi?id=380609
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633738

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 7fb3e02..53e0d51 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1466,7 +1466,7 @@ static int __init ip6_tunnel_init(void)
 {
        int  err;
 
-       err = register_pernet_device(&ip6_tnl_net_ops);
+       err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops);
        if (err < 0)
                goto out_pernet;
Comment 2 Eugene Teo (Security Response) 2011-10-03 04:03:14 UTC 
Patch "Fix broken backport for IPv6 tunnels" has been added to the 2.6.32-longterm tree

upstream commit d5aa407f59f5b83d2c50ec88f5bf56d40f1f8978 ("tunnels: fix netns vs proto registration ordering") , which was included in 2.6.32.44-longterm, was not backported correctly, and results in a NULL pointer dereference in ip6_tunnel.c for longterm kernels >=2.6.32.44

this don't affect mrg-2.1 kernel.