summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* [PATCH] fix ia64 syscall auditingamy.griffis@hp.com2005-05-122-2/+5
| | | | | | | | | | | | | | | | | | | | | Attached is a patch against David's audit.17 kernel that adds checks for the TIF_SYSCALL_AUDIT thread flag to the ia64 system call and signal handling code paths. The patch enables auditing of system calls set up via fsys_bubble_down, as well as ensuring that audit_syscall_exit() is called on return from sigreturn. Neglecting to check for TIF_SYSCALL_AUDIT at these points results in incorrect information in audit_context, causing frequent system panics when system call auditing is enabled on an ia64 system. I have tested this patch and have seen no problems with it. [Original patch from Amy Griffis ported to current kernel by David Woodhouse] From: Amy Griffis <amy.griffis@hp.com> From: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Prevent race condition in jbdStephen Tweedie2005-05-121-3/+3
| | | | | | | | | | | | | Subject: Prevent race condition in jbd This patch from Stephen Tweedie which fixes a race in jbd code (it demonstrated itself as more or less random NULL dereferences in the journal code). Acked-by: Jan Kara <jack@suse.cz> Acked-by: Chris Mason <mason@suse.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Fix Oops with ALSA timer event notificationtiwai@suse.de2005-05-121-1/+4
| | | | | | | | | | | | the patch below fixes the bug of ALSA timer notification, which is used in the recent ALSA dmix plugin. - fixed Oops in read() - fixed wake-up polls and signals with new events Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Linux 2.6.11.6chrisw@osdl.org2005-05-121-1/+1
|
* [PATCH] Potential DOS in load_elf_libraryHerbert Xu2005-05-121-13/+17
| | | | | | | | | | Yichen Xie <yxie@cs.stanford.edu> points out that load_elf_library can modify `elf_phdata' before freeing it. CAN-2005-0749 is assigned to this issue. Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] Suspected information leak (mem pages) in ext2Mathieu Lafon2005-05-121-0/+1
| | | | | | | | | | | | I think I have discovered a potential security problem in ext2: when a new directory is created, the ext2 block written to disk is not initialized. Included is a proposed patch for Linux 2.6 (ext2_make_empty() function): CAN-2005-0400 is assigned to this issue. Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] Fix signedness problem at socket creationMarcel Holtmann2005-05-121-3/+3
| | | | | | | | | | | | | CAN-2005-0750 is assigned to this issue ilja <ilja@suresec.org> discovered potential local root exploit in bluetooth socket creation. This patch fixes a small signedness problem when creating the socket. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] isofs: more defensive checks against corrupt isofs imageschrisw@osdl.org2005-05-121-0/+4
| | | | | | | | | | | | | | | | Michal Zalewski <lcamtuf@dione.ids.pl> discovers range checking flaws in iso9660 filesystem. http://marc.theaimsgroup.com/?l=bugtraq&m=111110067304783&w=2 CAN-2005-0815 is assigned to this issue. Some more defensive checks to keep corrupt isofs images from corrupting memory or causing Oops. Signed-off-by: Chris Wright <chrisw@osdl.org> ===== fs/isofs/rock.c 1.23 vs edited =====
* [PATCH] isofs: more "corrupted iso image" error casestorvalds@osdl.org2005-05-121-0/+5
| | | | | | | | | | | | | | | | | Michal Zalewski <lcamtuf@dione.ids.pl> discovers range checking flaws in iso9660 filesystem. http://marc.theaimsgroup.com/?l=bugtraq&m=111110067304783&w=2 CAN-2005-0815 is assigned to this issue. From: Linus Torvalds <torvalds@osdl.org> isofs: more "corrupted iso image" error cases Thanks to Michal Zalewski for testing. Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] isofs: Handle corupted rock-ridge info slightly bettertorvalds@osdl.org2005-05-121-7/+14
| | | | | | | | | | | | | | | | | Michal Zalewski <lcamtuf@dione.ids.pl> discovers range checking flaws in iso9660 filesystem. http://marc.theaimsgroup.com/?l=bugtraq&m=111110067304783&w=2 CAN-2005-0815 is assigned to this issue. From: Linus Torvalds <torvalds@osdl.org> isofs: Handle corupted rock-ridge info slightly better. Keyword here being 'slightly'. The code is a mess. Signed-off-by: Chris Wright <chrisw@osdl.org>
* [PATCH] Linux 2.6.11.5gregkh@suse.de2005-05-121-1/+1
|
* [PATCH] Fix kernel panic on receive with WAN Hitachi SCA HD6457xkhc@pm.waw.pl2005-05-121-1/+1
| | | | | | | | | | | Another patch for 2.6.11.x: already in main tree, fixes kernel panic on receive with WAN cards based on Hitachi SCA/SCA-II: N2, C101, PCI200SYN. The attached patch fixes NULL pointer dereference on RX. Signed-off-by: Krzysztof Halasa <khc@pm.waw.pl> Acked-by: Jeff Garzik <jgarzik@pobox.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Possible VIA-Rhine free irq issuedilinger@debian.org2005-05-121-1/+3
| | | | | | | | | | | | | It seems to me that in the VIA Rhine device driver the requested irq might not be freed in case the alloc_ring() function fails. alloc_ring() can fail with a ENOMEM return value because of possible pci_alloc_consistent() failures. Updated to CodingStyle. Signed-off-by: Jeff Garzik <jgarzik@pobox.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] tasklist left lockedhugh@veritas.com2005-05-121-0/+1
| | | | | | | | | | | On 4-way SMP, about one reboot in twenty hangs while killing processes: exit needs exclusive tasklist_lock, but something still holds read_lock. do_signal_stop race case misses unlock, and fixing it fixes the symptom. Signed-off-by: Hugh Dickins <hugh@veritas.com> Acked-by: Roland McGrath <roland@redhat.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Fix check for underflowshemminger@osdl.org2005-05-121-1/+1
| | | | | | | | | | | | | | | | | | | | | http://bugme.osdl.org/show_bug.cgi?id=4279 Summary: When I try to start vpnc the net/core/skbuff.c:91 crash This check is wrong, gcc optimizes it away: if ((len -= sizeof(pi)) > len) return -EINVAL; This could be responsible for the BUG. If len is 2 or 3 and TUN_NO_PI isn't set it underflows. alloc_skb() allocates len + 2, which is 0 or 1 byte. skb_reserve tries to reserve 2 bytes and things explode in skb_put. [TUN]: Fix check for underflow Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Fix __xfrm_find_acq_byseq()davem@davemloft.net2005-05-121-1/+1
| | | | | | | | | | | | | | | This function, as it's name implies, is supposed to only return IPSEC objects which are in the XFRM_STATE_ACQ ("acquire") state. But it returns any object with the matching sequence number. This is wrong and confuses IPSEC daemons to no end. [XFRM]: xfrm_find_acq_byseq should only return XFRM_STATE_ACQ states. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Fix crash while reading /proc/net/routekaber@trash.net2005-05-121-1/+11
| | | | | | | | | [IPV4]: Fix crash while reading /proc/net/route caused by stale pointers Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Possible AMD8111e free irq issuedilinger@debian.org2005-05-121-0/+2
| | | | | | | | | | | | | | | | | | | It seems to me that if in the amd8111e_open() fuction dev->irq isn't zero and the irq request succeeds it might not get released anymore. Specifically, on failure of the amd8111e_restart() call the function returns -ENOMEM without releasing the irq. The amd8111e_restart() function can fail because of various pci_alloc_consistent() and dev_alloc_skb() calls in amd8111e_init_ring() which is being called by amd8111e_restart. 1374 if(dev->irq ==0 || request_irq(dev->irq, amd8111e_interrupt, SA_SHIRQ, 1375 dev->name, dev)) 1376 return -EAGAIN; Signed-off-by: Jeff Garzik <jgarzik@pobox.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Fix stereo mutes on Surround volume controldsd@gentoo.org2005-05-121-5/+8
| | | | | | | | | | | | | | | | | | | | | As of 2.6.11, I have no output out of the rear right speaker of my 4.1 surround sound setup. I am using snd-intel8x0 based on a Realtek ALC650F chip on an nvidia motherboard. A gentoo user with completely different hardware also ran into this: http://bugs.gentoo.org/84276 2.6.11-mm3 fixes this problem and I've identified the specific fix, which is already in the ALSA development tree. An ALSA developer asked me to submit the fix for 2.6.11.x when I'd found it, so here it is :) -- AC97 Codec Fix stereo mutes on Surround volume control. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] NetROM lockingralf@linux-mips.org2005-05-121-9/+0
| | | | | | | | | | Fix deadlock in NetROM due to double locking. I was sent the patch by Alan and have doublechecked it. This bug hits Net/ROM users really hard. It's accepted by DaveM - but just too late to make it into 2.6.11. Signed-off-by: Ralf Baechle <ralf@linux-mips.org> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Linux 2.6.11.4gregkh@suse.de2005-05-121-1/+1
|
* [PATCH] use strncpy in get_task_commPrasanna Meda2005-05-121-1/+1
| | | | | | | | | Set_task_comm uses strlcpy, so get_task_comm must use strncpy. Signed-Off-by: Prasanna Meda <pmeda@akamai.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] CAN-2005-0384: Remote Linux DoS on ppp serverspaulus@au1.ibm.com2005-05-121-1/+1
| | | | | | | | | | | | | | | | Martin Schulze writes: > Ben Martel and Stephen Blackheath have discovered a denial-of-service attack > that a client of pppd can make that can hang the server machine. The bug is > in the Linux kernel 2.6 (tested on 2.6.9), but it looks like it also exists > in the 2.4 series. Yes, this is my bug. :( I would just do this instead: Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Linux 2.6.11.3gregkh@suse.de2005-05-121-1/+1
|
* [PATCH] older chips oops on shutdownolof@austin.ibm.com2005-05-121-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Kernel 2.6.11, hardware is a MSI KT333-based board with an XP1800. I'm oopsing on shutdown on a machine that has a Via Rhine adapter in it: Unable to handle kernel paging request at virtual address e0803003 printing eip: c01f262c *pde = 014dc067 *pte = 00000000 Oops: 0000 [#1] Modules linked in: cpufreq_userspace cpufreq_powersave cpufreq_ondemand CPU: 0 EIP: 0060:[<c01f262c>] Not tainted VLI EFLAGS: 00010292 (2.6.11) EIP is at ioread8+0x2c/0x40 eax: e0803003 ebx: e0803003 ecx: c026b430 edx: e0803003 esi: dff90260 edi: e0802f80 ebp: dd117e74 esp: dd117e74 ds: 007b es: 007b ss: 0068 Process reboot (pid: 5769, threadinfo=dd117000 task=dfafa080) Stack: dd117e8c c026b490 dff90040 c151ccd4 c044a1a8 b7fdc078 dd117ea4 c0253ad9 c151ccd4 00000042 fee1dead 00000001 dd117fbc c012461c c04d72a8 00000001 00000000 00010800 00000000 dd117ed8 c013b40b dffe7380 00030800 00000000 Call Trace: [<c0103d5f>] show_stack+0x7f/0xa0 [<c0103efa>] show_registers+0x15a/0x1c0 [<c01040ce>] die+0xce/0x150 [<c0113406>] do_page_fault+0x356/0x692 [<c01039ff>] error_code+0x2b/0x30 [<c026b490>] rhine_shutdown+0x60/0x140 [<c0253ad9>] device_shutdown+0x89/0x8b [<c012461c>] sys_reboot+0xac/0x200 [<c0102f71>] sysenter_past_esp+0x52/0x75 Code: 3d ff ff 03 00 89 c2 89 e5 77 20 66 31 c0 3d 00 00 01 00 75 0c 81 e2 ff ff 00 00 ec 0f b6 c0 c9 c3 0f 0b 37 00 7b 65 3b c0 eb ea <0f> b6 00 eb ec eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 90 55 Seems like it is the ioread8 in: /* Hit power state D3 (sleep) */ iowrite8(ioread8(ioaddr + StickyHW) | 0x03, ioaddr + StickyHW); that fails. StickyHW is 0x83. lspci says: 0000:00:07.0 Ethernet controller: VIA Technologies, Inc. VT86C100A [Rhine] (rev 06) Flags: bus master, medium devsel, latency 32, IRQ 18 I/O ports at ec00 [size=128] Memory at dfffff80 (32-bit, non-prefetchable) [size=128] In other words, it's trying to read outside of the I/O range (0x80), which matches the fauling address. I'm guessing my chip revision doesn't support WOL, it's a crappy noname card. It does seem as if rhine_power_init checks quirks for rqWOL before touching any registers. Should rhine_shutdown do the same? Proposed patch below, which resolves the problem on my system. Check to make sure WOL is supported before setting it up in rhine_shutdown. Signed-off-by: Olof Johansson <olof@austin.ibm.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] sis900 kernel oops fixchrisw@osdl.org2005-05-121-16/+14
| | | | | | | | | | | | | | | | | | | | | | | | Backport of fix described below. From: Herbert Xu <herbert@gondor.apana.org.au> Fix bug #4223. OK, this happened because we got preempted before sis900_mii_probe finished setting the sis_priv->mii. Theoretically this can happen with SMP as well but I suppose the number of SMP machines with sis900 is fairly small. Anyway, the fix is to make sure that sis900_mii_probe is done before the device can be opened. This patch does it by moving the setup before register_netdevice. Since the netdev name is not available before register_netdev, I've changed the relevant printk's to use pci_name instead. Note that one of those printk's may be called after register_netdev as well. Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] r8169: receive descriptor length fixshemminger@osdl.org2005-05-121-7/+10
| | | | | | | | | The status and received packets indication in the Rx descriptor ring are not correctly reset when a descriptor is recycled. Signed-off-by: Francois Romieu <romieu@fr.zoreil.com> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] PCI: fix hotplug double freealexn@dsv.su.se2005-05-121-1/+2
| | | | | | | | | | | [PATCH] PCI: fix hotplug double free With the brackets missed out func could be freed twice. Found by Coverity tool Signed-off-by: Alexander Nyberg <alexn@dsv.su.se> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] ppc32: trivial fix for e500 oprofile buildgalak@freescale.com2005-05-121-2/+1
| | | | | | | | Fix for trivial fix for 2.6.11 oprofile compilation on e500 based ppc. Signed-off-by: Andy Fleming <afleming@freescale.com> Signed-off-by: Kumar Gala <kumar.gala@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Put back tcp_timer_bug_msg[] symbol export.davem@davemloft.net2005-05-121-0/+1
| | | | | | | | | | | | | | | | | | This wrecks the ipv6 modular build for a lot of people. In fact, since I always build ipv6 modular I am surprised I never hit this. My best guess is that my compiler is optimizing the reference away, but that can never be depended upon and the symbol export really is needed. [TCP]: Put back tcp_timer_bug_msg[] symbol export. It is needed for tcp_reset_xmit_timer(), which is invoked by tcp_prequeue() which is invoked from tcp_ipv6.c Signed-off-by: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Fix i2c messsage flags in video driverskhali@linux-fr.org2005-05-125-5/+5
| | | | | | | | | | | | | | | | | | While working on the saa7110 driver I found a problem with the way various video drivers (found on Zoran-based boards) prepare i2c messages to be used by i2c_transfer. The drivers improperly copy the i2c client flags as the message flags, while both sets are mostly unrelated. The net effect in this case is to trigger an I2C block read instead of the expected I2C block write. The fix is simply not to pass any flag, because none are needed. I think this patch qualifies hands down as a "critical bug fix" to be included in whatever bug-fix-only trees exist these days. As far as I can see, all Zoran-based boards are broken in 2.6.11 without this patch. Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] ppc32: Compilation fixes for Ebony, Luan and OcoteaMatt Porter2005-05-123-7/+7
| | | | | | | | | | | this patch fixes the problem, that the current kernel (linux-2.6.11-rc5) could not be compiled, when "support for early boot texts over serial port" (CONFIG_SERIAL_TEXT_DEBUG=y) is active. Signed-off-by: Gerhard Jaeger <gjaeger@sysgo.com> Signed-off-by: Matt Porter <mporter@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] drm missing memset can crash X server..airlied@linux.ie2005-05-121-0/+2
| | | | | | | | | | | Egbert Eich reported a bug 2673 on bugs.freedesktop.org and tracked it down to a missing memset in the setversion ioctl, this causes X server crashes... From: Egbert Eich <eich@pdx.freedesktop.org> Signed-off-by: Dave Airlie <airlied@linux.ie> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] cramfs: small stat(2) fixEric Lammerts2005-05-121-0/+1
| | | | | | | | | | When I stat(2) a device node on a cramfs, the st_blocks field is bogus (it's derived from the size field which in this case holds the major/minor numbers). This makes du(1) output completely wrong. Signed-off-by: Eric Lammerts <eric@lammerts.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] fix amd64 2.6.11 oops on modprobe (saa7110)khali@linux-fr.org2005-05-121-17/+16
| | | | | | | | | | | This is a rewrite of the saa7110_write_block function, which was plain broken in the case where the underlying adapter supports I2C_FUNC_I2C. It also includes related fixes which ensure that different parts of the driver agree on the number of registers the chip has. Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Linux 2.6.11.2gregkh@suse.de2005-05-121-1/+1
|
* [PATCH] epoll: return proper error on overflow conditiontorvalds@ppc970.osdl.org2005-05-121-1/+2
| | | | Noted by Georgi Guninski.
* [PATCH] Linux 2.6.11.1gregkh@suse.de2005-05-121-1/+1
|
* [PATCH] Fix keyboards for Dell machinesdtor_core@ameritech.net2005-05-121-3/+3
| | | | | | | | | | | | Some ACPI-related changes were recently made to i8042 discovery for ia64. Unfortunately this broke a significant number of Dell laptops due to their having incorrect BIOS tables. So, for now, arrange for the new code to be ia64-only. From: Dmitry Torokhov <dtor_core@ameritech.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] Fix for trivial fix for 2.6.11 raid6 compilation on ppc w/ Altivecolof@austin.ibm.com2005-05-121-0/+4
| | | | | | | | | | Here's a patch that will work for both PPC and PPC64. The proper way to fix this in mainline is to merge -mm's cpu_has_feature patch, but for the stable 2.6.11-series, this much less intrusive (i.e. just the pure bugfix, not the cleanup part). Signed-off-by: Olof Johansson <olof@austin.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* [PATCH] trivial fix for 2.6.11 raid6 compilation on ppc w/ AltivecRene Rebe2005-05-121-1/+1
| | | | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* 2.6.11 importGreg KH2005-05-1217091-0/+6623989
|
* Initial commitGreg KH2005-05-120-0/+0
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-28 23:32:01 +0000