Skip to content

L
linux-davinci
Switch branch/tag
  1. 27 Jun, 2005 31 commits
  3. 26 Jun, 2005 9 commits
    • pageexec's avatar
      [IPVS]: Fix for overflows · 4da62fc7
      pageexec authored 
      From: <pageexec@freemail.hu>

$subject was fixed in 2.4 already, 2.6 needs it as well.

The impact of the bugs is a kernel stack overflow and privilege escalation
from CAP_NET_ADMIN via the IP_VS_SO_SET_STARTDAEMON/IP_VS_SO_GET_DAEMON
ioctls.  People running with 'root=all caps' (i.e., most users) are not
really affected (there's nothing to escalate), but SELinux and similar
users should take it seriously if they grant CAP_NET_ADMIN to other users.
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4da62fc7
    • Sascha Hauer's avatar
      [PATCH] DM9000 network driver bugfix · 5f6b5517
      Sascha Hauer authored 
      This patch fixes two bugs in the dm9000 network driver:

- Don't read one byte too much in 8bit mode.
- release correct resource
Signed-off-by: default avatarJochen Karrer <j.karrer@lightmaze.com>
Signed-off-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      5f6b5517
    • Ismail Donmez's avatar
      [PATCH] Documentation/networking/dmfe.txt: Make documentation nicer · 1db1a874
      Ismail Donmez authored 
      Patch indents dmfe.txt to look like other docs.  It adds a tip about CNET
cards using Davicom chipsets.  Also it removes parts where it refers to how
to build driver out-of-kernel which seems to be cruft from times where the
driver was out of the kernel.
Signed-off-by: default avatarIsmail Donmez <ismail@kde.org.tr>
Signed-off-by: default avatarDomen Puncer <domen@coderock.org>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      1db1a874
    • Denis Vlasenko's avatar
      [PATCH] fealnx.c calls dev_kfree_skb from atomic context · 400de2c0
      Denis Vlasenko authored 
      Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      400de2c0
    • Pavel Machek's avatar
      [PATCH] fix int vs. pm_message_t confusion in airo · 1cc68ae0
      Pavel Machek authored 
      Fix int vs. pm_message_t confusion in airo. Should change no code.
Signed-off-by: default avatarPavel Machek <pavel@suse.cz>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      1cc68ae0
    • Maciej W. Rozycki's avatar
      [PATCH] defxx: Use irqreturn_t for the interrupt handler · feea1db2
      Maciej W. Rozycki authored 
      This is a fix for the interrupt handler in the defxx driver to use
irqreturn_t.  Beside the obvious fix of returning a proper status at all,
it actually checks board registers as appropriate for determining if an
interrupt has been recorded in the bus-specific interface logic.

The patch also includes an obvious one-line fix for SET_NETDEV_DEV needed
for the EISA variation, for which I've decided there is no point in sending
separately.
Signed-off-by: default avatarMaciej W. Rozycki <macro@linux-mips.org>
Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      feea1db2
    • Andrew Morton's avatar
      [PATCH] dmfe warning fix · 16b110c3
      Andrew Morton authored 
      drivers/net/tulip/dmfe.c: In function `dmfe_parse_srom':
drivers/net/tulip/dmfe.c:1805: warning: passing arg 1 of `__le16_to_cpup' from incompatible pointer type
drivers/net/tulip/dmfe.c:1817: warning: passing arg 1 of `__le32_to_cpup' from incompatible pointer type
drivers/net/tulip/dmfe.c:1817: warning: passing arg 1 of `__le32_to_cpup' from incompatible pointer type

This is basically a guess:

Cc: Jeff Garzik <jgarzik@pobox.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      16b110c3
    • Adrian Bunk's avatar
      [PATCH] document that 8139TOO supports 8129/8130 · f04e3f09
      Adrian Bunk authored 
      The 8129/8130 support is a sub-option that is not visible if the user
hasn't enabled the 8139 support.

Let's make it a bit easier for users to find the driver for their nic.
Signed-off-by: default avatarAdrian Bunk <bunk@stusta.de>
      f04e3f09
    • David S. Miller's avatar
      [NETLINK]: Fix two socket hashing bugs. · d470e3b4
      David S. Miller authored 
      1) netlink_release() should only decrement the hash entry
   count if the socket was actually hashed.

   This was causing hash->entries to underflow, which
   resulting in all kinds of troubles.

   On 64-bit systems, this would cause the following
   conditional to erroneously trigger:

	err = -ENOMEM;
	if (BITS_PER_LONG > 32 && unlikely(hash->entries >= UINT_MAX))
		goto err;

2) netlink_autobind() needs to propagate the error return from
   netlink_insert().  Otherwise, callers will not see the error
   as they should and thus try to operate on a socket with a zero pid,
   which is very bad.

   However, it should not propagate -EBUSY.  If two threads race
   to autobind the socket, that is fine.  This is consistent with the
   autobind behavior in other protocols.

   So bug #1 above, combined with this one, resulted in hangs
   on netlink_sendmsg() calls to the rtnetlink socket.  We'd try
   to do the user sendmsg() with the socket's pid set to zero,
   later we do a socket lookup using that pid (via the value we
   stashed away in NETLINK_CB(skb).pid), but that won't give us the
   user socket, it will give us the rtnetlink socket.  So when we
   try to wake up the receive queue, we dive back into rtnetlink_rcv()
   which tries to recursively take the rtnetlink semaphore.

Thanks to Jakub Jelink for providing backtraces.  Also, thanks to
Herbert Xu for supplying debugging patches to help track this down,
and also finding a mistake in an earlier version of this fix.
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d470e3b4