igmp: Avoid zero delay when receiving odd mixture of IGMP queries (Closes: #654876) (CVE-2012-0207)

svn path=/dists/sid/linux-2.6/; revision=18484

debian/changelog

@@ -1,3 +1,10 @@
+linux-2.6 (3.1.8-2) unstable; urgency=high
+
+  * igmp: Avoid zero delay when receiving odd mixture of IGMP queries
+    (Closes: #654876) (CVE-2012-0207)
+
+ -- Ben Hutchings <ben@decadent.org.uk>  Tue, 10 Jan 2012 00:14:39 +0000
+
 linux-2.6 (3.1.8-1) unstable; urgency=low
 
   * New upstream stable update:

debian/patches/bugfix/all/igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch

@@ -0,0 +1,36 @@
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Mon, 9 Jan 2012 14:06:46 -0800
+Subject: [PATCH] igmp: Avoid zero delay when receiving odd mixture of IGMP
+ queries
+
+commit a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27 upstream.
+
+Commit 5b7c84066733c5dfb0e4016d939757b38de189e4 ('ipv4: correct IGMP
+behavior on v3 query during v2-compatibility mode') added yet another
+case for query parsing, which can result in max_delay = 0.  Substitute
+a value of 1, as in the usual v3 case.
+
+Reported-by: Simon McVittie <smcv@debian.org>
+References: http://bugs.debian.org/654876
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/ipv4/igmp.c |    2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index fa057d1..5104bc0 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -880,6 +880,8 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+ 		 * to be intended in a v3 query.
+ 		 */
+ 		max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
++		if (!max_delay)
++			max_delay = 1;	/* can't mod w/ 0 */
+ 	} else { /* v3 */
+ 		if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
+ 			return;
+-- 
+1.7.8.2
+

debian/patches/series/base

@@ -96,3 +96,4 @@
 + bugfix/all/limit-ioctls-forwarded-to-non-scsi-devices.patch
 + bugfix/all/treat-lvs-on-one-pv-like-a-partition.patch
 + bugfix/x86/kvm-prevent-starting-pit-timers-in-the-absence-of-irqchip-support.patch
++ bugfix/all/igmp-Avoid-zero-delay-when-receiving-odd-mixture-of-.patch