1. 13 Mar, 2008 5 commits
    • Yoshinori Sato's avatar
      h8300: fix recent uaccess breakage · 12d48739
      Yoshinori Sato authored
      Al Viro wrote:
      >
      > 	After that commit in asm-h8300/uaccess.h we have
      >
      > #define get_user(x, ptr)                                        \
      > ({                                                              \
      >     int __gu_err = 0;                                           \
      >     uint32_t __gu_val = 0;                              \
      >     ^^^^^^^^^^^^^^^^^
      >     switch (sizeof(*(ptr))) {                                   \
      >     case 1:                                                     \
      >     case 2:                                                     \
      >     case 4:                                                     \
      >         __gu_val = *(ptr);                                      \
      >         break;                                                  \
      >     case 8:                                                     \
      >         memcpy(&__gu_val, ptr, sizeof (*(ptr)));                \
      >                                ^^^^^^^^^^^^^^^^
      >
      > which, of course, is FUBAR whenever we actually hit that case - memcpy of
      > 8 bytes into uint32_t is obviously wrong.  Why don't we simply do
      
      Cc: Al Viro <viro@ZenIV.linux.org.uk>
      Signed-off-by: default avatarYoshinori Sato <ysato@users.sourceforge.jp>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      12d48739
    • Marcelo Tosatti's avatar
      pagemap: proper read error handling · fb39380b
      Marcelo Tosatti authored
      Fix pagemap_read() error handling by releasing acquired resources and checking
      for get_user_pages() partial failure.
      Signed-off-by: default avatarMarcelo Tosatti <mtosatti@redhat.com>
      Acked-by: default avatarMatt Mackall <mpm@selenic.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fb39380b
    • Ahmed S. Darwish's avatar
      smackfs: do not trust `count' in inodes write()s · b500ce8d
      Ahmed S. Darwish authored
      Smackfs write() implementation does not put a higher bound on the number of
      bytes to copy from user-space.  This may lead to a DOS attack if a malicious
      `count' field is given.
      
      Assure that given `count' is exactly the length needed for a /smack/load rule.
       In case of /smack/cipso where the length is relative, assure that `count'
      does not exceed the size needed for a buffer representing maximum possible
      number of CIPSO 2.2 categories.
      Signed-off-by: default avatarAhmed S. Darwish <darwish.07@gmail.com>
      Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b500ce8d
    • Linus Torvalds's avatar
      Merge master.kernel.org:/home/rmk/linux-2.6-arm · 93d74463
      Linus Torvalds authored
      * master.kernel.org:/home/rmk/linux-2.6-arm: (26 commits)
        [ARM] 4856/1: Orion: initialise the sixth PCIe MBUS mapping window as well
        [ARM] 4855/1: Orion: use correct ethernet unit address range
        [ARM] 4853/1: include uImage target in make help
        [ARM] 4851/1: ns9xxx: fix size of gpiores
        [ARM] AT91: correct at91sam9263ek LCD power gpio pin
        [ARM] replace remaining __FUNCTION__ occurrences
        [ARM] 4850/1: include generic pgtable.h for !CONFIG_MMU case
        [ARM] 4849/1: move ATAGS asm definitions
        [ARM] 4848/1: at91: remove false lockdep warnings
        [ARM] 4847/1: kprobes: fix compilation with CONFIG_DEBUG_FS=y
        [ARM] include/asm-arm - use angle brackets for includes
        [ARM] 4845/1: Orion: Ignore memory tags with invalid data
        ARM: OMAP2: Register the L4 io bus to boot OMAP2
        ARM: OMAP1: Compile in other 16xx boards to OSK defconfig
        ARM: OMAP1: Refresh H2 defconfig
        ARM: OMAP1: Refresh OSK defconfig
        ARM: OMAP: gpio lockdep updates
        ARM: OMAP1: omap1/pm.c build fix
        ARM: OMAP1: omap h2 regression fix
        ARM: OMAP1: Fix compile for boards depending on old gpio expander
        ...
      93d74463
    • Linus Torvalds's avatar
      Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc · c463be35
      Linus Torvalds authored
      * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: (22 commits)
        [POWERPC] Fix large hash table allocation on Cell blades
        [POWERPC] Export empty_zero_page
        [POWERPC] Fix viodasd driver with scatterlist debug
        [POWERPC] Fix arch/powerpc/platforms/powermac/pic.c when !CONFIG_ADB_PMU
        [POWERPC] Fix drivers/macintosh/mediabay.c when !CONFIG_ADB_PMU
        [POWERPC] Fix undefined pmu_sys_suspended compilation error
        [POWERPC] Fix build of modular drivers/macintosh/apm_emu.c
        [POWERPC] Fix sleep on some powerbooks
        [POWERPC] Fix bogus test for unassigned PCI resources
        [POWERPC] Fix zImage-dtb.initrd build error
        [POWERPC] Add __ucmpdi2 for 64-bit comparisons in 32-bit kernels
        [POWERPC] spufs: fix rescheduling of non-runnable contexts
        [POWERPC] spufs: don't (ab)use SCHED_IDLE
        [POWERPC] QE: Make qe_get_firmware_info reentrant
        [POWERPC] 83xx: Make 83xx perfmon support selectable
        [PPC] 8xx: swap bug-fix
        [POWERPC] 85xx: sbc8548 - Fix incorrect PCI-X and PCI interrupt map
        [POWERPC] QE: Fix QE firmware uploading limit
        [POWERPC] 8xx: Fix wrapper platform for adder875, and combine defconfigs.
        [POWERPC] 8xx: fix swap
        ...
      c463be35
  2. 12 Mar, 2008 35 commits