summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* [PATCH] x86_64: When checking vmalloc mappings don't use pte_pageAndi Kleen2005-05-261-2/+9
| | | | | | | | | | | The PTEs can point to ioremap mappings too, and these are often outside mem_map. The NUMA hash page lookup functions cannot handle out of bounds accesses properly. Signed-off-by: Andi Kleen <ak@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] x86_64: Add a guard page at the end of the 47bit address spaceAndi Kleen2005-05-261-2/+2
| | | | | | | | | This works around a bug in the AMD K8 CPUs. Signed-off-by: Andi Kleen <ak@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] x86_64: Fix canonical checking for segment registers in ptraceAndi Kleen2005-05-261-4/+4
| | | | | | | | | | | | | | Allowed user programs to set a non canonical segment base, which would cause oopses in the kernel later. Credit-to: Alexander Nyberg <alexn@dsv.su.se> For identifying and reporting this bug. Signed-off-by: Andi Kleen <ak@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] x86_64: check if ptrace RIP is canonicalAndi Kleen2005-05-261-0/+5
| | | | | | | | | This works around an AMD Erratum. Signed-off-by: Andi Kleen <ak@suse.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] USB: fix bug in visor driver with throttle/unthrottle causing oopses.gregkh@suse.de2005-05-261-11/+27
| | | | | | | Thanks to Mark Lord <mlord@pobox.com> for reporting this and helping with testing. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] usbusx2y: prevent oops & dead keyboard on usb unplugging while the ↵Gregor Jasny2005-05-261-4/+7
| | | | | | | | | | | | | | | | | | | device is being used Summary: prevent oops & dead keyboard on usb unplugging while the device is being used Without this patch, some usb kobjects, which are parents to the usx2y's kobjects can be freed before the usx2y's. This led to an oops in get_kobj_path_length() and a dead keyboard, when the usx2y's kobjects were freed. The patch ensures the correct sequence. Tested ok on kernel 2.6.12-rc2. Present in ALSA cvs Signed-off-by: Karsten Wiese <annabellesgarden@yahoo.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] usbaudio: prevent oops & dead keyboard on usb unplugging while the ↵Gregor Jasny2005-05-261-1/+1
| | | | | | | | | | | | | | | | | | | device is being used Summary: prevent oops & dead keyboard on usb unplugging while the device is being used Without this patch, some usb kobjects, which are parents to the usx2y's kobjects can be freed before the usx2y's. This led to an oops in get_kobj_path_length() and a dead keyboard, when the usx2y's kobjects were freed. The patch ensures the correct sequence. Tested ok on kernel 2.6.12-rc2. Present in ALSA cvs Signed-off-by: Karsten Wiese <annabellesgarden@yahoo.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] Fix minor security holeralf@linux-mips.org2005-05-261-1/+2
| | | | | | | | | ROSE wasn't verifying the ndigis argument of a new route resulting in a minor security hole. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] ide-disk: Fix LBA8 DMADaniel Drake2005-05-261-1/+3
| | | | | | | | | | | | This is from Gentoo's 2.6.11 patchset. A problem was introduced in 2.6.10 where some users could not enable DMA on their disks (particularly ALi15x3 users). This was a small mistake with the no_lba48_dma flag. I can't find the exact commit but this is definately included in 2.6.12-rc4. From: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] Fix matroxfb on big-endian hardwarevandrove@vc.cvut.cz2005-05-262-5/+13
| | | | | | | | | | | | | | | There was too much/too few byteswapping done by driver and hardware in matroxfb on big endian hardware. Change fixes mirrored/split/corrupted letters seen on screen when using accelerated matroxfb mode. Patch was tested on Mips (by Peter) and x86-64 (by Petr). Signed-off-by: Peter 'p2' De Schrijver <p2@mind.be> Signed-off-by: Petr Vandrovec <vandrove@vc.cvut.cz> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] PPC64: Fix LPAR IOMMU setup code for p630olof@austin.ibm.com2005-05-261-1/+54
| | | | | | | | | | | | | | Here's a fix to deal with p630 systems in LPAR mode. They're to date the only system that in some cases might lack a dma-window property for the bus, but contain an overriding property in the device node for the specific adapter/slot. This makes the device setup code a bit more complex since it needs to do some of the things that the bus setup code has already done. Signed-off-by: Olof Johansson <olof@austin.ibm.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] ext3: fix race between ext3 make block reservation and reservation ↵cmm@us.ibm.com2005-05-261-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | window discard This patch fixed a race between ext3_discard_reservation() and ext3_try_to_allocate_with_rsv(). There is a window where ext3_discard_reservation will remove an already unlinked reservation window node from the filesystem reservation tree: It thinks the reservation is still linked in the filesystem reservation tree, but it is actually temperately removed from the tree by allocate_new_reservation() when it failed to make a new reservation from the current group and try to make a new reservation from next block group. Here is how it could happen: CPU 1 try to allocate a block in group1 with given reservation window my_rsv ext3_try_to_allocate_with_rsv(group ----copy reservation window my_rsv into local rsv_copy ext3_try_to_allocate(...rsv_copy) ----no free block in existing reservation window, ----need a new reservation window spin_lock(&rsv_lock); CPU 2 ext3_discard_reservation if (!rsv_is_empty() ----this is true spin_lock(&rsv_lock) ----waiting for thread 1 CPU 1: allocate_new_reservation failed to reserve blocks in this group remove the window from the tree rsv_window_remove(my_rsv) ----window node is unlinked from the tree here return -1 spin_unlock(&rsv_lock) ext3_try_to_allocate_with_rsv() failed in this group group++ CPU 2 spin_lock(&rsv_lock) succeed rsv_remove_window () ---------------break, trying to remove a unlinked node from the tree .... CPU 1: ext3_try_to_allocate_with_rsv(group, my_rsv) rsv_is_empty is true, need a new reservation window spin_lock(&rsv_lock); ^--------------- spinning forever We need to re-check whether the reservation window is still linked to the tree after grab the rsv_lock spin lock in ext3_discard_reservation, to prevent panic in rsv_remove_window->rb_erase. Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] Fix smp race.bdschuym@pandora.be2005-05-261-1/+2
| | | | | | | | | | | | The patch below fixes an smp race that happens on such systems under heavy load. This bug was reported and solved by Steve Herrell <steve_herrell@yahoo.ca> Signed-off-by: Bart De Schuymer <bdschuym@pandora.be> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] 3c59x: only put the device into D3 when we're actually using WOLdaniel.ritz@gmx.ch2005-05-261-3/+6
| | | | | | | | | | During a warm boot the device is in D3 and has troubles coming out of it. Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] Fix get_unmapped_area sanity testsLinus Torvalds2005-05-262-29/+34
| | | | | | | | | | | Fix get_unmapped_area sanity tests As noted by Chris Wright, we need to do the full range of tests regardless of whether MAP_FIXED is set or not, so re-organize get_unmapped_area() slightly to do the sanity checks unconditionally. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org>
* Linux 2.6.11.10Greg KH2005-05-161-1/+1
|
* [PATCH] Fix root hole in pktcdvdPeter Osterlund2005-05-161-2/+2
| | | | | | | | | | | | | | ioctl_by_bdev may only be used INSIDE the kernel. If the "arg" argument refers to memory that is accessed by put_user/get_user in the ioctl function, the memory needs to be in the kernel address space (that's the set_fs(KERNEL_DS) doing in the ioctl_by_bdev). This works on i386 because even with set_fs(KERNEL_DS) the user space memory is still accessible with put_user/get_user. That is not true for s390. In short the ioctl implementation of the pktcdvd device driver is horribly broken. Signed-off-by: Peter Osterlund <petero2@telia.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Fix root hole in raw deviceDave Jones2005-05-162-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [Patch] Fix raw device ioctl pass-through Raw character devices are supposed to pass ioctls through to the block devices they are bound to. Unfortunately, they are using the wrong function for this: ioctl_by_bdev(), instead of blkdev_ioctl(). ioctl_by_bdev() performs a set_fs(KERNEL_DS) before calling the ioctl, redirecting the user-space buffer access to the kernel address space. This is, needless to say, a bad thing. This was noticed first on s390, where raw IO was non-functioning. The s390 driver config does not actually allow raw IO to be enabled, which was the first part of the problem. Secondly, the s390 kernel address space is distinct from user, causing legal raw ioctls to fail. I've reproduced this on a kernel built with 4G:4G split on x86, which fails in the same way (-EFAULT if the address does not exist kernel-side; returns success without actually populating the user buffer if it does.) The patch below fixes both the config and address-space problems. It's based closely on a patch by Jan Glauber <jang@de.ibm.com>, which has been tested on s390 at IBM. I've tested it on x86 4G:4G (split address space) and x86_64 (common address space). Kernel-address-space access has been assigned CAN-2005-1264. Signed-off-by: Stephen Tweedie <sct@redhat.com> Signed-off-by: Dave Jones <davej@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Linux 2.6.11.9gregkh@suse.de2005-05-121-1/+1
|
* [PATCH] fix Linux kernel ELF core dump privilege elevationgregkh@suse.de2005-05-121-2/+2
| | | | | | | | As reported by Paul Starzetz <ihaquer@isec.pl> Reference: CAN-2005-1263 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Remove bogus BUG() in kernel/exit.cakpm@osdl.org2005-05-121-2/+0
| | | | | | | | | | | Remove bogus BUG() in kernel/exit.c It's old sanity checking that may have been useful for debugging, but is just bogus these days. Noticed by Mattia Belletti. Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Security contact infochrisw@osdl.org2005-05-123-0/+47
| | | | | | | | Add security contact info and relevant documentation. Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* [PATCH] I2C: Fix incorrect sysfs file permissions in it87 and via686a driverskhali@linux-fr.org2005-05-122-2/+2
| | | | | | | | | | | | | | | | | | The it87 and via686a hardware monitoring drivers each create a sysfs file named "alarms" in R/W mode, while they should really create it in read-only mode. Since we don't provide a store function for these files, write attempts to these files will do something undefined (I guess) and bad (I am sure). My own try resulted in a locked terminal (where I attempted the write) and a 100% CPU load until next reboot. As a side note, wouldn't it make sense to check, when creating sysfs files, that readable files have a non-NULL show method, and writable files have a non-NULL store method? I know drivers are not supposed to do stupid things, but there is already a BUG_ON for several conditions in sysfs_create_file, so maybe we could add two more? Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Cset exclude: khali@linux-fr.org[gregkh]|ChangeSet|20050430010004|65088gregkh@suse.de2005-05-123-7/+2
| | | | | | | Revert the msdos.c patch as it causes more problems than it helps right now. (it got munged together with the i2c patch also, stupid scripts...) Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Linux 2.6.11.8gregkh@suse.de2005-05-121-2/+2
|
* [PATCH] sparc64: use message queue compat syscallsdavem@davemloft.net2005-05-121-1/+1
| | | | | | | | | | A couple message queue system call entries for compat tasks were not using the necessary compat_sys_*() functions, causing some glibc test cases to fail. From: "David S. Miller" <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] sparc64: Fix copy_sigingo_to_user32()jurij@wooyd.org2005-05-121-1/+4
| | | | | | | | | | | | | Because this routine was not filling in the siginfo values for si_band and si_fd, this broke applications trying to actually get at this data. This makes the sparc64 code in line with PowerPC64's implementation, which already gets it right. Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] sparc: Fix PTRACE_CONT bogositydavem@davemloft.net2005-05-122-31/+0
| | | | | | | | | | | | | | | | | | | | | SunOS aparently had this weird PTRACE_CONT semantic which we copied. If the addr argument is something other than 1, it sets the process program counter to whatever that value is. This is different from every other Linux architecture, which don't do anything with the addr and data args. This difference in particular breaks the Linux native GDB support for fork and vfork tracing on sparc and sparc64. There is no interest in running SunOS binaries using this weird PTRACE_CONT behavior, so just delete it so we behave like other platforms do. From: "David S. Miller" <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] uml: quick fix syscall tableblaisorblade@yahoo.it2005-05-123-18/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I'm resending this for inclusion in the -stable tree. I've deleted whitespace cleanups, and hope this can be merged. I've been asked to split the former patch, I don't know if I must split again this one, even because I don't want to split this correct patch into multiple non-correct ones by mistake. Uml 2.6.11 does not compile with gcc 2.95.4 because some entries are duplicated, and that GCC does not accept this (unlike gcc 3). Plus various other bugs in the syscall table definitions, resulting in probable wrong syscall entries: *) 223 is a syscall hole (i.e. ni_syscall) only on i386, on x86_64 it's a valid syscall (thus a duplicated one). *) __NR_vserver must be only once with sys_ni_syscall, and not multiple times with different values! *) syscalls duplicated in SUBARCHs and in common files (thus assigning twice to the same array entry and causing the GCC 2.95.4 failure mentioned above): sys_utimes, which is common, and sys_fadvise64_64, sys_statfs64, sys_fstatfs64, which exist only on i386. *) syscalls duplicated in each SUBARCH, to put in common files: sys_remap_file_pages, sys_utimes, sys_fadvise64 *) 285 is a syscall hole (i.e. ni_syscall) only on i386, on x86_64 the range does not arrive to that point. *) on x86_64, the macro name is __NR_kexec_load and not __NR_sys_kexec_load. Use the correct name in either case. Note: as you can see, part of the syscall table definition in UML is arch-independent (with everywhere defined syscalls), and part is arch-dependant. This has created confusion (some syscalls are listed in both places, some in the wrong one, some are wrong on one arch or another). Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Fix reproducible SMP crash in security/keys/key.cakpm@osdl.org2005-05-121-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Jani Jaakkola <jjaakkol@cs.Helsinki.FI> wrote: > > SMP race handling is broken in key_user_lookup() in security/keys/key.c This was fixed post-2.6.11. Can you confirm that 2.6.12-rc2 works OK? This is the patch we used. It should go into -stable if it's not already there. From: Alexander Nyberg <alexn@dsv.su.se> I looked at some of the oops reports against keyrings, I think the problem is that the search isn't restarted after dropping the key_user_lock, *p will still be NULL when we get back to try_again and look through the tree. It looks like the intention was that the search start over from scratch. Signed-off-by: Alexander Nyberg <alexn@dsv.su.se> Cc: David Howells <dhowells@redhat.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] I2C: Fix incorrect sysfs file permissions in it87 and via686a driverskhali@linux-fr.org2005-05-123-2/+7
| | | | | | | | | | | | | | | | | | The it87 and via686a hardware monitoring drivers each create a sysfs file named "alarms" in R/W mode, while they should really create it in read-only mode. Since we don't provide a store function for these files, write attempts to these files will do something undefined (I guess) and bad (I am sure). My own try resulted in a locked terminal (where I attempted the write) and a 100% CPU load until next reboot. As a side note, wouldn't it make sense to check, when creating sysfs files, that readable files have a non-NULL show method, and writable files have a non-NULL store method? I know drivers are not supposed to do stupid things, but there is already a BUG_ON for several conditions in sysfs_create_file, so maybe we could add two more? Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] modprobe bttv freezes the computerjs@linuxtv.org2005-05-121-2/+0
| | | | | | | | | | | | | Here's a patch that fixes http://bugme.osdl.org/show_bug.cgi?id=4395. Patch by Manu Abraham and Gerd Knorr: Remove redundant bttv_reset_audio() which caused the computer to freeze with some bt8xx based DVB cards when loading the bttv driver. Signed-off-by: Johannes Stezenbach <js@linuxtv.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Gerd Knorr <kraxel@bytesex.org>
* [PATCH] Linux 2.6.11.7gregkh@suse.de2005-05-121-1/+1
|
* [PATCH] uml: va_copy fixblaisorblade@yahoo.it2005-05-121-1/+2
| | | | | | | | Uses __va_copy instead of va_copy since some old versions of gcc (2.95.4 for instance) don't accept va_copy. Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Fix BIC congestion avoidance algorithm errordavem@davemloft.net2005-05-121-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since BIC is the default congestion control algorithm enabled in every 2.6.x kernel out there, fixing errors in it becomes quite critical. A flaw in the loss handling caused it to not perform the binary search regimen of the BIC algorithm properly. The fix below from Stephen Hemminger has been heavily verified. [TCP]: BIC not binary searching correctly While redoing BIC for the split up version, I discovered that the existing 2.6.11 code doesn't really do binary search. It ends up being just a slightly modified version of Reno. See attached graphs to see the effect over simulated 1mbit environment. The problem is that BIC is supposed to reset the cwnd to the last loss value rather than ssthresh when loss is detected. The correct code (from the BIC TCP code for Web100) is in this patch. Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] rwsem fixakpm@osdl.org2005-05-122-22/+36
| | | | | | | | | | | | | | | | | | | | | | | | We should merge this backport - it's needed to prevent deadlocks when dio_complete() does up_read() from IRQ context. And perhaps other places. From: David Howells <dhowells@redhat.com> [PATCH] rwsem: Make rwsems use interrupt disabling spinlocks The attached patch makes read/write semaphores use interrupt disabling spinlocks in the slow path, thus rendering the up functions and trylock functions available for use in interrupt context. This matches the regular semaphore behaviour. I've assumed that the normal down functions must be called with interrupts enabled (since they might schedule), and used the irq-disabling spinlock variants that don't save the flags. Signed-Off-By: David Howells <dhowells@redhat.com> Tested-by: Badari Pulavarty <pbadari@us.ibm.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Do not hold state lock while checking sizekaber@trash.net2005-05-122-12/+12
| | | | | | | | | | | | | | | | | This patch from Herbert Xu fixes a deadlock with IPsec. When an ICMP frag. required is sent and the ICMP message needs the same SA as the packet that caused it the state will be locked twice. [IPSEC]: Do not hold state lock while checking size. This can elicit ICMP message output and thus result in a deadlock. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] I2C: Fix oops in eeprom driverkhali@linux-fr.org2005-05-121-1/+2
| | | | | | | | | | | | | | | | | | | | | | This fixes an oops in the eeprom driver. It was first reported here: http://bugzilla.kernel.org/show_bug.cgi?id=4347 It was additionally discussed here (while tracking a completely different bug): http://archives.andrew.net.au/lm-sensors/msg30021.html The patch is already in 2.6.12-rc1: http://linux.bkbits.net:8080/linux-2.5/cset@1.2227 The oops happens when one reads data from the sysfs interface file such that (off < 16) and (count < 16 - off). For example "sensors" from lm_sensors 2.9.0 does this, and causes the oops. Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] fix ia64 syscall auditingamy.griffis@hp.com2005-05-122-2/+5
| | | | | | | | | | | | | | | | | | | | | Attached is a patch against David's audit.17 kernel that adds checks for the TIF_SYSCALL_AUDIT thread flag to the ia64 system call and signal handling code paths. The patch enables auditing of system calls set up via fsys_bubble_down, as well as ensuring that audit_syscall_exit() is called on return from sigreturn. Neglecting to check for TIF_SYSCALL_AUDIT at these points results in incorrect information in audit_context, causing frequent system panics when system call auditing is enabled on an ia64 system. I have tested this patch and have seen no problems with it. [Original patch from Amy Griffis ported to current kernel by David Woodhouse] From: Amy Griffis <amy.griffis@hp.com> From: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Prevent race condition in jbdStephen Tweedie2005-05-121-3/+3
| | | | | | | | | | | | | Subject: Prevent race condition in jbd This patch from Stephen Tweedie which fixes a race in jbd code (it demonstrated itself as more or less random NULL dereferences in the journal code). Acked-by: Jan Kara <jack@suse.cz> Acked-by: Chris Mason <mason@suse.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Fix Oops with ALSA timer event notificationtiwai@suse.de2005-05-121-1/+4
| | | | | | | | | | | | the patch below fixes the bug of ALSA timer notification, which is used in the recent ALSA dmix plugin. - fixed Oops in read() - fixed wake-up polls and signals with new events Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Linux 2.6.11.6chrisw@osdl.org2005-05-121-1/+1
|
* [PATCH] Potential DOS in load_elf_libraryHerbert Xu2005-05-121-13/+17
| | | | | | | | | | Yichen Xie <yxie@cs.stanford.edu> points out that load_elf_library can modify `elf_phdata' before freeing it. CAN-2005-0749 is assigned to this issue. Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] Suspected information leak (mem pages) in ext2Mathieu Lafon2005-05-121-0/+1
| | | | | | | | | | | | I think I have discovered a potential security problem in ext2: when a new directory is created, the ext2 block written to disk is not initialized. Included is a proposed patch for Linux 2.6 (ext2_make_empty() function): CAN-2005-0400 is assigned to this issue. Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] Fix signedness problem at socket creationMarcel Holtmann2005-05-121-3/+3
| | | | | | | | | | | | | CAN-2005-0750 is assigned to this issue ilja <ilja@suresec.org> discovered potential local root exploit in bluetooth socket creation. This patch fixes a small signedness problem when creating the socket. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] isofs: more defensive checks against corrupt isofs imageschrisw@osdl.org2005-05-121-0/+4
| | | | | | | | | | | | | | | | Michal Zalewski <lcamtuf@dione.ids.pl> discovers range checking flaws in iso9660 filesystem. http://marc.theaimsgroup.com/?l=bugtraq&m=111110067304783&w=2 CAN-2005-0815 is assigned to this issue. Some more defensive checks to keep corrupt isofs images from corrupting memory or causing Oops. Signed-off-by: Chris Wright <chrisw@osdl.org> ===== fs/isofs/rock.c 1.23 vs edited =====
* [PATCH] isofs: more "corrupted iso image" error casestorvalds@osdl.org2005-05-121-0/+5
| | | | | | | | | | | | | | | | | Michal Zalewski <lcamtuf@dione.ids.pl> discovers range checking flaws in iso9660 filesystem. http://marc.theaimsgroup.com/?l=bugtraq&m=111110067304783&w=2 CAN-2005-0815 is assigned to this issue. From: Linus Torvalds <torvalds@osdl.org> isofs: more "corrupted iso image" error cases Thanks to Michal Zalewski for testing. Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] isofs: Handle corupted rock-ridge info slightly bettertorvalds@osdl.org2005-05-121-7/+14
| | | | | | | | | | | | | | | | | Michal Zalewski <lcamtuf@dione.ids.pl> discovers range checking flaws in iso9660 filesystem. http://marc.theaimsgroup.com/?l=bugtraq&m=111110067304783&w=2 CAN-2005-0815 is assigned to this issue. From: Linus Torvalds <torvalds@osdl.org> isofs: Handle corupted rock-ridge info slightly better. Keyword here being 'slightly'. The code is a mess. Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] Linux 2.6.11.5gregkh@suse.de2005-05-121-1/+1
|
* [PATCH] Fix kernel panic on receive with WAN Hitachi SCA HD6457xkhc@pm.waw.pl2005-05-121-1/+1
| | | | | | | | | | | Another patch for 2.6.11.x: already in main tree, fixes kernel panic on receive with WAN cards based on Hitachi SCA/SCA-II: N2, C101, PCI200SYN. The attached patch fixes NULL pointer dereference on RX. Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl> Acked-by: Jeff Garzik <jgarzik@pobox.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-30 17:01:02 +0000