Commits · 55820ee2f8c767a2833b21bd365e5753f50bd8ce · linux / linux-davinci

05 Jul, 2005 1 commit

[NET]: Fix signedness issues in net/core/filter.c · 55820ee2

Patrick McHardy authored Jul 05, 2005

This is the code to load packet data into a register:

                        k = fentry->k;
                        if (k < 0) {
...
                        } else {
                                u32 _tmp, *p;
                                p = skb_header_pointer(skb, k, 4, &_tmp);
                                if (p != NULL) {
                                        A = ntohl(*p);
                                        continue;
                                }
                        }

skb_header_pointer checks if the requested data is within the
linear area:

        int hlen = skb_headlen(skb);

        if (offset + len <= hlen)
                return skb->data + offset;

When offset is within [INT_MAX-len+1..INT_MAX] the addition will
result in a negative number which is <= hlen.

I couldn't trigger a crash on my AMD64 with 2GB of memory, but a
coworker tried on his x86 machine and it crashed immediately.

This patch fixes the check in skb_header_pointer to handle large
positive offsets similar to skb_copy_bits. Invalid data can still
be accessed using negative offsets (also similar to skb_copy_bits),
anyone using negative offsets needs to verify them himself.

Thanks to Thomas Vögtle <thomas.voegtle@coreworks.de> for verifying the
problem by crashing his machine and providing me with an Oops.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

55820ee2

04 Jul, 2005 3 commits

[PATCH] ARM: Fix new-ABI layout of struct stat64 · 17af691c

Russell King authored Jul 04, 2005

Add __attribute__((packed)) to ensure that the stat64 structure is
correctly laid out no matter which ABI the kernel is compiled for.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

17af691c

[PATCH] ARM: Fix non-standard PXA io_pg_offst initialisers · 68070bde

Russell King authored Jul 04, 2005

These didn't match my sed expression correctly, fix them up manually.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

68070bde

[PATCH] ARM: Change 'param_offset' to 'boot_params' · f9bd6ea4
Russell King authored Jul 04, 2005
```
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
```
f9bd6ea4

03 Jul, 2005 21 commits

Merge master.kernel.org:/home/rmk/linux-2.6-arm · 19f7241a
Linus Torvalds authored Jul 03, 2005

19f7241a
Merge master.kernel.org:/home/rmk/linux-2.6-serial · 08ab8c20
Linus Torvalds authored Jul 03, 2005

08ab8c20

[PATCH] Serial: Fix console port spinlock initialisation · 976ecd12

Russell King authored Jul 03, 2005

Initialise the spinlock for port being used by the console early, but
don't re-initialise it again later.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

976ecd12

[PATCH] ARM: 2784/1: Fix the block cache flush operation range · 0d670b41

Catalin Marinas authored Jul 03, 2005

Patch from Catalin Marinas

The range for the ARMv6 block cache operations is inclusive but the
kernel doesn't re-calculate the end address, causing a page fault when
used (this only happens with support for cache aliasing, otherwise the
blk_flush_kern_dcache_page() is not called). This patch subtracts
L1_CACHE_BYTES from the end address.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

0d670b41

[PATCH] ARM: 2785/1: S3C24XX - serial calls request_irq() with IRQs disabled · 75f631dc

Ben Dooks authored Jul 03, 2005

Patch from Ben Dooks

The request_irq() function is called by s3c24xx uart driver with
the local IRQs disabled. The request_irq() function can allocate
memory via kmalloc(), and this may sleep causing a warning about
sleeping in an invalid context.
Signed-off-by: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

75f631dc

[PATCH] ARM: Remove machine description macros · e9dea0c6

Russell King authored Jul 03, 2005

Remove the pointless machine description macros, favouring C99
initialisers instead.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

e9dea0c6

[PATCH] drivers/ide/Makefile: kill dead CONFIG_BLK_DEV_IDE_TCQ entry · 10e047b4

Adrian Bunk authored Jul 03, 2005

This patch kills the dead CONFIG_BLK_DEV_IDE_TCQ entry.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@elka.pw.edu.pl>

10e047b4

[PATCH] amd74xx: support MCP55 device IDs · 21e2c01d

Rob Punkunus authored Jul 03, 2005

From: Rob Punkunus <rpunkunus@nvidia.com>

Rob Punkunus recently submitted a patch to enable support for MCP51/MCP55 in
the amd74xx driver. This patch was whitespace-corrupted and didn't apply to
2.6.12 since MCP51 support was merged in the 2.6.12-rc series.

Gentoo would like to support this hardware for our upcoming release media, so
I fixed the patch, and here it is :)
Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@elka.pw.edu.pl>

21e2c01d

[PATCH] ide: fix line break in ide messages · 13bbbf28

Denis Vlasenko authored Jul 03, 2005

From: Denis Vlasenko <vda@ilport.com.ua>

* printk("\n") is misplaced, resulting in stray empty line in kernel log
* cleanups nerby: some back-to-back printks are combined, etc
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@elka.pw.edu.pl>

13bbbf28