OSDN Git Service
Willy Tarreau [Mon, 13 Aug 2007 08:50:08 +0000 (10:50 +0200)]
[PATCH] sysctl to prevent normal processes from mapping NULL
After a patch proposal from Solar Designer, and discussions with
Alan Cox and Chris Wright, I modeled this patch which permits to
restrict mapping of lower virtual addresses to CAP_RAW_IO capable
processes only.
This makes it harder for processes to try to exploit NULL pointer
dereference bugs in the kernel.
In order to ease transition from 2.4 to 2.6, the patch has also
been inspired by Eric Paris's patch now present in 2.6, which
adds the sys/vm/mmap_min_addr sysctl by which the lowest mappable
address is set. This sysctl defaults to zero, meaning NULL is
allowed by default.
According to test ran by Solar Designer, both Xorg and Wine run
correctly as a normal user with the restriction enabled. There
should be very few regressions when enabling it, and it is
recommended to enable it on servers after the obviously needed
validation.
Alan points that some rare programs use a trick consisting in
mapping this page in order to reduce the number of NULL checks
in linked lists for instance.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sat, 8 Sep 2007 15:32:26 +0000 (17:32 +0200)]
[PATCH] restore -fno-unit-at-a-time on GCC >= 4
-fno-unit-at-a-time was removed for gcc >= 4 in order to
support gcc 4.2. Unfortunately, this caused nasty problems
in many modules which had some of their read-only parameters
optimized away.
So we have to restore -fno-unit-at-a-time for the moment.
This will break gcc 4.2 again, and another solution will be
needed in order to support it. Note that -fno-unit-at-a-time
may not be supported in future versions of gcc.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Wed, 5 Sep 2007 21:39:11 +0000 (23:39 +0200)]
[PATCH] i386: do_test_wp_bit() must not be inlined
do_test_wp_bit() has a comment stating that it must not be inlined.
Unfortunately, the trick to prevent it from being inlined is not
reliable under gcc 4.x.
The simple fix consists in specifying the noinline attribute.
Tested and confirmed to produce the correct code for gcc versions
2.95.3, 3.3.6, 3.4.6, 4.0.2, 4.1.1 and 4.2.1.
Special thanks to Axel Reinhold and Richard Kojedzinszky for their
continuous feedback when trying to solve this issue.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Wed, 15 Aug 2007 07:15:09 +0000 (09:15 +0200)]
[PATCH] CVE-2007-3848 Privilege escalation via PR_SET_PDEATHSIG
Fix the "parent process death signal" vulnerability in the Linux kernel
discovered by Wojciech Purczynski of COSEINC PTE Ltd. and iSEC Security
Research (CVE-2007-3848).
To sum up, any local user could manage to start a setuid program then
send it an arbitrary signal while it is running, by first setting the
PR_SET_PDEATHSIG argument of the prctl() system call, and then running
another setuid program from the parent process. This is something the
user is normally supposed to be able to do only as long as the setuid
program has not completely switched its UID.
Depending on the installed setuid programs, this may lead to either a
denial of service or even to a privilege escalation, so this issue is
very distribution specific.
For more information regarding this issue, please refer to the original
advisory :
http://www.isec.pl/vulnerabilities/isec-0024-death-signal.txt
The following fix has been provided by Solar Designer and is already
part of the latest Openwall kernel.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Thu, 9 Aug 2007 21:07:01 +0000 (23:07 +0200)]
[PATCH] second build fix for some rare buggy versions of GCC 4
Last gcc4 fix
78bf0892b4008a0011f7af916460bc59103acd0a uncoverred a known
bug which appeared in gcc between 4.1 and 4.2.0 and which makes it ignore
the first -fno-builtin-xxx when more than one of those params is passed.
This resulted in the kernel not building with some versions such as
gcc version 4.1.2
20061115 (prerelease) as shipped by Debian as version
4.1.1-21.
Since those versions do not need -fno-builtin-strpbrk, set this option
first so that it doesn't matter wether it's ignored. This fix was confirmed
by Richard Kojedzinszky. So with this fix, we know the kernel builds on x86
with gcc-4.1.1 (already did), 4.1.2-
20061115, and 4.2.1.
Reference to the thread discussing this bug on gcc-ml :
http://gcc.gnu.org/ml/gcc-bugs/2006-07/msg01514.html
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 5 Aug 2007 16:37:07 +0000 (18:37 +0200)]
[PATCH] fix incorrect use of -fno-unit-at-a-time on GCC >= 4
Axel Reinhold reported wrong code being emitted for arch/i386/kernel/i8259.c
using gcc-4.2, while the same code with gcc-4.1 was valid. The problem was
tracked down to gcc-4.2 messing up with sections with this option which is
already deprecated for gcc 4.x, and the asm statements were incorrectly
assigned to section .data. It was also possible to trick gcc-4.1 into the
same error by simply declaring an array before any asm statement.
The correct fix is to remove -fno-unit-at-a-time with gcc >= 4, which is
also what has been done in 2.6. In anticipation of such other problems with
gcc 4.x, a new function "if_gcc4" has been added to the main Makefile.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Sun, 5 Aug 2007 18:29:52 +0000 (20:29 +0200)]
[PATCH] do not use gcc's builtin strpbrk
Some drivers rely on strpbrk and complain about a lack of strchr().
This is caused by gcc's builtin strpbrk which must be disabled.
Willy Tarreau [Sun, 5 Aug 2007 18:48:46 +0000 (20:48 +0200)]
[PATCH] module fdomain_cs requires fdomain_setup()
The function which was called was once declared static
and once extern. Also, the arguments were messed up. That
one must not have worked for a long time.
Willy Tarreau [Sun, 5 Aug 2007 19:12:11 +0000 (21:12 +0200)]
[PATCH] wdt83627: fix wdt_init() return code
wdt_init() could return an uninitialized value if it
could not create a /proc entry.
Willy Tarreau [Sun, 5 Aug 2007 19:50:20 +0000 (21:50 +0200)]
[PATCH] fix wdt83627 build breakage with gcc 4.x
gcc 4 complains about a function declared static after
being used.
Marc Haisenko [Fri, 3 Aug 2007 12:34:39 +0000 (14:34 +0200)]
[PATCH] b44: fix force mac address before ifconfig up
Hi Willy,
I discovered that a bug in the Broadcom driver that has been fixed in the 2.6
tree is still present in 2.4 (up to 2.4.35). In our case it resulted in a
complete system crash when starting the net-snmp daemon (not even a kernel
panic is seen; the system is just gone).
The patch is rather trivial, here's the link to the patch from the netdev
tree:
http://git.kernel.org/?p=linux/kernel/git/jgarzik/netdev-2.6.git;a=commit;h=
5c5131297db57b501f371ab53c40343eac6f2af7
It applies cleanly to 2.4.35 (with fuzz offset, of course :-)
Bye,
Marc
--
Marc Haisenko
Comdasys AG
---- patch below ----
From: Gary Zambrano <zambrano@broadcom.com>
Date: Wed, 29 Mar 2006 22:12:05 -0500
Subject: b44: fix force mac address before ifconfig up
Initializing the b44 MAC & PCI functional blocks in the controller must
occur inside init_one(). This will allow access to the MAC registers.
The controller was being powered up in b44_open() which would not allow
access to the registers before ifconfig was up.
Philip Kohlbecher found this bug.
Signed-off-by: Gary Zambrano <zambrano@broadcom.com>
Willy Tarreau [Fri, 27 Jul 2007 15:05:27 +0000 (17:05 +0200)]
[PATCH] build fix for lvm with gcc 4
Reported by Marco Gatti :
I decided to upgrade from 2.4.34 to 2.4.35 in one of my servers but i
encountered a compile problem:
lvm.c:397: error: static declaration of 'vg_count' follows non-static
declaration
lvm-internal.h:48: error: previous declaration of 'vg_count' was here
I know this was an already fixed bug but now it seems to come out again
compiling 2.4.35 vanilla with gcc version 4.1.3
20070629 (prerelease) (Debian
4.1.2-13). 2.4.34.6 vanilla compiled fine.
Simple fix below tested and confirmed by Marco.
Willy Tarreau [Thu, 26 Jul 2007 20:53:41 +0000 (22:53 +0200)]
Change VERSION to 2.4.35
Willy Tarreau [Sun, 22 Jul 2007 13:39:09 +0000 (15:39 +0200)]
Change VERSION to 2.4.35-rc1
- 2.4.34 - VIA VT8237A support
- Add some AHCI PCI IDs
- notsc support for x86_64
- Fix divide by 0 in vegas_cong_avoid()
- random device reseed bugfix, possibly security problem
- SATA update: add ICH8 PCI IDs
- Documentations/SubmittingPatches was outdated
Willy Tarreau [Sun, 22 Jul 2007 11:43:19 +0000 (13:43 +0200)]
[PATCH] Documentations/SubmittingPatches was outdated
Li Yang <leo@zh-kernel.org> proposed a patch to update
SubmittingPatches in 2.6, and looking at 2.4's state, it
was clearly outdated. I just updated to the 2.6 version
without the section about power management.
Filippo Carletti [Wed, 6 Jun 2007 20:16:14 +0000 (22:16 +0200)]
[PATCH] Add some AHCI PCI IDs
This patch adds support for some chipsets in AHCI driver.
The list comes from a patch for redhat kernel 2.6.9-34.
I only tested ICH8.
Ciao,
Filippo
Filippo Carletti [Fri, 1 Jun 2007 09:25:14 +0000 (11:25 +0200)]
[PATCH] 2.4.34 - VIA VT8237A support
This patch adds support for VIA VT8237A.
It enables DMA on IDE and it makes sata drives work.
Tested on an Asus VINTAGE V2-P5V90.
Ciao,
Filippo
Vincent Bernat [Thu, 21 Jun 2007 07:41:58 +0000 (09:41 +0200)]
[PATCH] SATA update: add ICH8 PCI IDs
I have patched 2.4.34 with the following patch to allow the use of
SATA drive on an ICH8 motherboard. This works fine for the disk but
this does not work for the SATA CDROM. There is no PATA controller
on the motherboard (Dell OptiPlex 745). There is no change when
disabling ATA/IDE support. With an ICH7 controller, CDROM is not
working either.
Lior Dotan [Tue, 29 May 2007 09:18:19 +0000 (12:18 +0300)]
[PATCH] Fix divide by 0 in vegas_cong_avoid()
Hi,
I had a divide by zero on kernel 2.4.33 running with Vegas enabled.
What happens is that vegas_rtt_calc() gets rtt as -1, so when it adds
1 the rtt is set to zero.
It seems that the -1 came from tcp_clean_rtx_queue() so I made this
small patch to fix the problem. I think it is also relevant to 2.6.
Don't perform congestion avoidance on packets that we didn't calculate
there RTT, as this may result in a divide by zero later on.
Signed-off-by: Lior Dotan <liodot@gmail.com>
PaX Team [Mon, 18 Jun 2007 08:56:16 +0000 (10:56 +0200)]
[PATCH] random device reseed bugfix, possibly security problem
hello,
recently while trying to figure out something i ran across
some code in drivers/char/random.c:xfer_secondary_pool() which
looked wrong and further investigation of history confirmed
it as well.
the problem is that xfer_secondary_pool() used to use a local
buffer in the past that was used during the reseed operation
however when this buffer was moved out to the caller site, the
sizeof(tmp) code wasn't properly adjusted, therefore the sizeof
now operates on a pointer type (vs. array) and gives the wrong
result.
in this case it means that when the code thinks it reseeds the
entire buffer (0x154 bytes on i386/sha1), it only reseeds
sizeof(ptr), 4 bytes on i386.
since all this 'catastrophic reseeding' has something to do with
some (maybe theoretical) attack (i'm not a crypto guy to tell ;),
i can imagine that this error has some security consequences,
please treat it as such until confirmed otherwise.
the commit that introduced the bug:
http://linux.bkbits.net:8080/linux-2.6/?PAGE=cset&REV=1.889.325.12
the attached fix has been in PaX/grsecurity for a few weeks now
and seems to work.
2.6 doesn't have this bug as the buffer in question is again
local to the function that uses sizeof on it (i haven't checked
when it was fixed).
Krzysztof Strasburger [Thu, 21 Jun 2007 19:57:09 +0000 (21:57 +0200)]
[PATCH] notsc support for x86_64
This patch deals with a problem with unsynced TSCs on dual core Athlon 64.
The time goes sometimes backwards with TSC based gettimeofday(), while the
dummy routine gives time resolution of 10 milliseconds, which is too coarse
for some applications. There are no HPET timers on the mainboard, so I ported
the good old gettimeoffset_slow routine from arch/i386. It seems to work and
gives nice time resolution of about 5 microseconds.
In order to use this code, one will have to specify the "notsc" option on
the kernel command line, just as on x86.
Kernel 2.6 does not need this code as it uses different techniques to
workaround the unsynced TSCs.
Willy Tarreau [Wed, 6 Jun 2007 06:45:58 +0000 (08:45 +0200)]
Change VERSION to 2.4.35-pre5
- fix 'pc_keyb: controller jammed (0xA7)' error on systems with KVM
- do not mark init_idle() __init
- Bluetooth: correct fix for CVE-2007-1353
- [BACKPORT] Bluetooth: Fix NULL pointer dereference in HCI line discipline
- [BACKPORT] Bluetooth: Fix unintentional fall-through in HCI line discipline
- lvm: update to latest fixes from the LVM package
- lvm: do not update extent count if snapshot allocation fails
Willy Tarreau [Wed, 6 Jun 2007 06:29:49 +0000 (08:29 +0200)]
[PATCH] lvm: do not update extent count if snapshot allocation fails
Fix from RHEL3 U8, explained by Heinz Mauelshagen :
That change makes sure that the extent count *only* gets updated in
case the allocation of the snapshot succeeds. Like you said: proper
error path handling.
Willy Tarreau [Wed, 6 Jun 2007 06:24:30 +0000 (08:24 +0200)]
[PATCH] lvm: update to latest fixes from the LVM package
greg@enjellic.com suggested to apply the recommended patches from
the LVM package, as every LVM user will have to generate them and
apply them anyway. Heinz Mauelshagen agreed, except for the list_del
chunk in the snapshot code which was identified as responsible for
oopses encountered in RHEL3.
Now with this patch in 2.4, it should be safe(r) to not apply the
LVM patches anymore.
Willy Tarreau [Wed, 6 Jun 2007 06:00:44 +0000 (08:00 +0200)]
[BACKPORT] Bluetooth: Fix unintentional fall-through in HCI line discipline
Backport from this 2.6 patch :
A trivial fix to (what looks like) an unintentional fall-through in the
HCI line discipline.
Signed-off-by: Ohad Ben-Cohen <ohad@bencohen.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Willy Tarreau [Wed, 6 Jun 2007 05:59:12 +0000 (07:59 +0200)]
[BACKPORT] Bluetooth: Fix NULL pointer dereference in HCI line discipline
Backport from this 2.6 patch :
Normally a serial Bluetooth device is opened, TIOSETD'ed to N_HCI line
discipline, HCIUARTSETPROTO'ed and finally closed. In case the device
fails to HCIUARTSETPROTO, closing it produces a NULL pointer dereference.
Signed-off-by: Ohad Ben-Cohen <ohad@bencohen.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Willy Tarreau [Wed, 6 Jun 2007 05:50:57 +0000 (07:50 +0200)]
[PATCH] Bluetooth: correct fix for CVE-2007-1353
Marcel Holtmann notified me that my previous fix for CVE-2007-1353
was wrong because of a stupid memcpy() with unchecked length, which
indeed made it worse than the original bug. Next time I'll be more
careful with copy-pasting !
Willy Tarreau [Tue, 5 Jun 2007 05:26:30 +0000 (07:26 +0200)]
[PATCH] do not mark init_idle() __init
Zbigniew Baniewski reported a panic at boot when using
CONFIG_BLK_DEV_IDEDISK=m. The code crashed when calling init_idle().
PaX Team brought to my attention that init_idle() is marked __init,
and is called from cpu_idle() (which is not) itself called from
rest_init() (which is not either), on top of which there is a big
shiny comment :
* We need to finalize in a non-__init function or else race conditions
* between the root thread and the init thread may cause start_kernel to
* be reaped by free_initmem before the root thread has proceeded to
* cpu_idle.
Indeed. Simply removing __init from init_idle fixed the panic.
Brian Maly [Wed, 25 Apr 2007 19:13:13 +0000 (15:13 -0400)]
[PATCH 2.4.35-pre4] fix 'pc_keyb: controller jammed (0xA7)' error on systems with KVM
Ive had a few requests for this patch, so Im posting it against
linux-2.4.35-pre4 kernel.
Various hardware (IBM BladeCenter, Sun Fire servers, and many other
bladeserver systems)
have an integrated KVM or console switch. The keyboard type on these
systems is often USB,
and the hardware usually does not have a legacy PS/2 console keyboard.
The 2.4 kernel always tries to
initialize the keyboard controller by default, and on systems without
such a keyboard present
at boot you get the following errors spewed to the logs:
Jun 3 10:21:06 sbknpwaq3 kernel: pc_keyb: controller jammed (0xA7).
Jun 3 10:21:08 sbknpwaq3 last message repeated 249 times
Jun 3 10:21:08 sbknpwaq3 kernel: Keyboard timed out[1]
Jun 3 10:21:08 sbknpwaq3 kernel: pc_keyb: controller jammed (0xA7).
Jun 3 10:21:08 sbknpwaq3 last message repeated 249 times
Jun 3 10:21:08 sbknpwaq3 kernel: Keyboard timed out[1]
This patch allows the kernel to skip the keyboard controller init so the
kernel does not try to initialize, fail
and spew errors when no keyboard is attached. This can also be used for
various systems without a traditional
console keyboard present at boot (includes USB or IrDA keyboard too and
systems connected to KVM's).
Ive provided the dmi_scan magic in this parch for the IBM BladeCenter,
but on other hardware, use the "nokeyb"
kernel-param at boot to skip the initialization.
Tested on IBM BladeCenter, and Sun Fire.
Signed-off-by: Brian Maly <bmaly@redhat>
Regards, Brian
Documentation/kernel-parameters.txt | 4 ++++
arch/i386/kernel/dmi_scan.c | 24 ++++++++++++++++++++++++
drivers/char/pc_keyb.c | 15 +++++++++++----
3 files changed, 39 insertions(+), 4 deletions(-)
Willy Tarreau [Sun, 22 Apr 2007 15:51:51 +0000 (17:51 +0200)]
Change VERSION to 2.4.35-pre4
- recent patch to fib_semantics broke build
Urs Thermann [Sun, 22 Apr 2007 15:43:50 +0000 (17:43 +0200)]
[PATCH] recent patch to fib_semantics broke build
Fix label name.
Willy Tarreau [Sun, 22 Apr 2007 09:29:02 +0000 (11:29 +0200)]
Change VERSION to v2.4.35-pre3
- init/main.c: remove comment that gcc 4 was not supported
- Linux 2.4.x MTD CFI P30/P33 support
- 2.6 backport of Watchdog wdt83627 (Winbond W83627HF/F/HG/G) driver
- Watchdog w83977ef (Winbond W83977EF) driver
- [DECNet] fib: Fix out of bound access of dn_fib_props[]
- [IPv4] fib: Fix out of bound access of fib_props[]
- [PPP]: Don't leak an sk_buff on interface destruction.
- Fix TCP receiver side SWS handling
- [Bluetooth] Fix L2CAP and HCI setsockopt() information leaks (CVE-2007-1353)
Tal Kelrich [Tue, 10 Apr 2007 11:54:32 +0000 (14:54 +0300)]
[PATCH] Watchdog w83977ef (Winbond W83977EF) driver
This driver has been derived from Netwinder's in order not to
modify it. Tested and working on AAEON GENE-6310B Subcompact
Board (also configured for same by default, should work elsewhere)
patch is against kernel 2.4.34.2
Changes/Features:
- Added ioctl support
- Disables watchdog on driver load
- Supports timeout in seconds
- Timeout defaults to 2 minutes
- No longer under NetWinder arch
- Configurable output GP (defaults to GP16)
- Configurable base IO address
- Non standard read only proc interface for status (/proc/watchdog)
Caveats:
- Only tested with GP16
- Utterly ignores inability to get its IO port, mostly because it's
already taken. I didn't know a way around that.
- release_region is called regardless of having acquired the region,
this might be trouble.
Tal Kelrich [Tue, 10 Apr 2007 11:49:42 +0000 (14:49 +0300)]
[PATCH] 2.6 backport of Watchdog wdt83627 (Winbond W83627HF/F/HG/G) driver
Tested and working on Kontron JREX-PM.
Fairly straightforward backport of w83627hf_wdt.c from 2.6.20.1
Changes from 2.6 version
- Default timeout set to 120 seconds
- Nonstandard read only proc interface (/proc/watchdog)
- Always reset timer on driver load
- Changed timeout limit to 255
- Ignores failure to acquire IO port
Caveats:
- Ignores failure to acquire IO port since it is always taken, there's
probably a better way around that.
- Releases IO port regardless of having acquired it.
Willy Tarreau [Sat, 14 Apr 2007 16:23:12 +0000 (18:23 +0200)]
[Bluetooth] Fix L2CAP and HCI setsockopt() information leaks (CVE-2007-1353)
Problem reported by Ilja van Sprundel. Assigned CVE-2007-1353.
Fix below from Marcel Holtmann, backported to 2.4.
The L2CAP and HCI setsockopt() implementations have a small information
leak that makes it possible to leak kernel stack memory to userspace.
If the optlen parameter is 0, no data will be copied by copy_from_user(),
but the uninitialized stack buffer will be read and stored later. A call
to getsockopt() can now retrieve the leaked information.
To fix this problem the stack buffer given to copy_from_user() must be
initialized with the current settings.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Willy Tarreau [Sat, 14 Apr 2007 16:01:31 +0000 (18:01 +0200)]
[PATCH] Fix TCP receiver side SWS handling
Problem reported, analyzed and initially fixed by Alex Sidorenko.
Definitive fix by John Heffner, confirmed by Alex.
Analysis below :
this is a rare corner case met by one of HP partners on 2.4.20 on IA64.
Inspecting the sources of the latest 2.6.20.1 (net/ipv4/tcp_output.c) we can
see that the bug is still there.
Here is a description of the bug and the suggested fix.
The problem occurs when the remote host (not necessarily Linux - in our case
it was Solaris) does not implement SWS avoidance on sender side. If Linux
connection socket has rcvbuf<mtu, we can potentially advertise small rcv_wnd
for a long time (SWS).
The problem is due to SWS avoidance as implemented in __tcp_select_window().
Everything works fine when rcvbuf > mtu. But if we use small rcvbuf (set by
SO_RCVBUF), we can go into SWS mode.
[...]
If there is no SWS avoidance on sender side, we can see Linux advertising the
same small rcv_wnd over and over again. The problem here is that we never
advertise one-half the receiver's buffer space as described e.g. in
"TCP/IP Illustrated" by Stevens (v.1, Chapter 22.3):
"The normal algorithm is for the receiver not to advertise a larger window
than it is currently advertising (which can be 0) until the window can be
increased by either one full-sized segment (i.e. the MSS being received) or by
one-half the receiver's buffer space, whichever is smaller"
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The fix.
--------
We have not been able to reproduce the problem inside HP as it is unclear what
conditions are needed to bring system into SWS mode (this needs very special
event timing). HP customer was seeing it every 2-3 days while running a
custom application (Solaris<->Linux) that was running with low priority on a
busy host running other custom applications with SCHED_RR. After going into
SWS mode, his application stayed in it until restarted.
Willy Tarreau [Sat, 14 Apr 2007 15:54:16 +0000 (17:54 +0200)]
[PPP]: Don't leak an sk_buff on interface destruction.
Initial 2.6 patch :
Signed-off-by: G. Liakhovetski <gl@dsa-ac.de>
Acked-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Willy Tarreau [Sat, 14 Apr 2007 15:44:03 +0000 (17:44 +0200)]
[IPv4] fib: Fix out of bound access of fib_props[]
Backported from 2.6. Bug found and fixed by Thomas Graf :
Fixes a typo which caused fib_props[] to have the wrong size
and makes sure the value used to index the array which is
provided by userspace via netlink is checked to avoid out of
bound access.
Willy Tarreau [Sat, 14 Apr 2007 15:39:47 +0000 (17:39 +0200)]
[DECNet] fib: Fix out of bound access of dn_fib_props[]
Backported from 2.6. Found and fixed from Thomas Graf :
Fixes a typo which caused fib_props[] to have the wrong size
and makes sure the value used to index the array which is
provided by userspace via netlink is checked to avoid out of
bound access.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Alexey Korolev [Tue, 10 Apr 2007 20:18:28 +0000 (22:18 +0200)]
[PATCH] Linux 2.4.x MTD CFI P30/P33 support
The following patch adds support of P30 and P33 NOR FLASH support in
Linux 2.4
This flash is substitution of J3 flash which is widely used it on Linux
2.4 kernels. Currently many customers wishing to substitute J3 for P3x
face issues on Linux 2.4. This patch resolves issues with P3x on all
generic Linux kernels versions since 2.4.21.
The patch just allows using minor version "4" in CFI driver. Since
differences between CFI minor version "3" and minor version "4" are
small the CFI driver is not affected by this. Patch has been verified on
Mainstone (PXA27x based) platform.
Signed-off-by: Alexey Korolev <alexey.korolev@intel.com>
Adrian Bunk [Wed, 4 Apr 2007 21:38:01 +0000 (23:38 +0200)]
[PATCH] init/main.c: remove comment that gcc 4 was not supported
When the #error was removed, the comment was forgotten.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Willy Tarreau [Sat, 24 Mar 2007 06:51:21 +0000 (07:51 +0100)]
Change VERSION to v2.4.35-pre2
- fix channel balance on TV cards with LG head
- fix build of serial with DEBUG enabled
- usb-storage: backport unusual_devs from 2.6.20
- usb-storage: HP-FDC-GOLD need US_FL_SINGLE_LUN
- make it possible to compile x86_64 without VT support
- add nforce-MCP55 chipset ID
- restore ability to set disk geometry on command line
- parenthesis fixes
- usb 2.4: Support high-speed HID
- IPV6: ipv6_fl_socklist is inadvertently shared.
Willy Tarreau [Thu, 22 Mar 2007 20:22:10 +0000 (21:22 +0100)]
[PATCH] IPV6: ipv6_fl_socklist is inadvertently shared.
Backport from 2.6. Original patch from Masayuki Nakagawa, with
his description below :
"
The ipv6_fl_socklist from listening socket is inadvertently shared
with new socket created for connection. This leads to a variety of
interesting, but fatal, bugs. For example, removing one of the
sockets may lead to the other socket's encountering a page fault
when the now freed list is referenced.
The fix is to not share the flow label list with the new socket.
"
original patch:
Signed-off-by: Masayuki Nakagawa <nakagawa.msy@ncos.nec.co.jp>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Willy Tarreau [Thu, 22 Mar 2007 22:02:01 +0000 (23:02 +0100)]
[PATCH] remove excess parenthesis in video/cyberfb
My previous fix was wrong, the parenthesis remained unbalanced.
Krzysztof Strasburger [Fri, 16 Mar 2007 05:04:12 +0000 (06:04 +0100)]
[PATCH] restore ability to set disk geometry on command line
The second patch is a two-liner, which adds (restores?) the possibility to
specify your own disk geometry in the kernel command line. Default values
of 255 heads and 63 sectors can be nonoptimal, i.e. a small part of the
disk remains unused.
BTW sometimes it is desirable to set a specific geometry on small devices
such as flash disks.
Krzysztof Strasburger [Fri, 16 Mar 2007 04:59:52 +0000 (05:59 +0100)]
[PATCH] add nforce-MCP55 chipset ID
This patch contains a backport of NFORCE-MCP55 chipset driver from 2.6.
In fact, the code was already there and it was sufficient to identify this
chipset.
Krzysztof Strasburger [Fri, 16 Mar 2007 04:33:47 +0000 (05:33 +0100)]
[PATCH] make it possible to compile x86_64 without VT support
Add #ifdef CONFIG_VT where appropriate so that we can build the kernel
without VT support on x86_64.
Willy Tarreau [Sun, 25 Feb 2007 07:55:44 +0000 (08:55 +0100)]
[PATCH] fix missing parenthesis in unused macro in ip_nat_standalone
The bug found by Mariusz Kozlowski affects an unused macro. However,
I prefer to fix the macro than removing it because external patches
might be relying on it.
Willy Tarreau [Sun, 25 Feb 2007 07:52:53 +0000 (08:52 +0100)]
[PATCH] add missing parenthesis in video/cyberfb
The bug found by Mariusz Kozlowski affects an unused macro. However,
I prefer to fix the macro than removing it because external patches
might be relying on it.
Willy Tarreau [Fri, 1 Dec 2006 15:50:09 +0000 (16:50 +0100)]
[PATCH] ia64 kernel entry fix
Mariusz Kozlowski sent me this patch :
I noticed some parenthesis thing here but I'd be glad if anyone would
confirm thath the patch below is correct. This code looks magic to me ;-)
No replies. A quick look at 2.6 shows the code was fixed by removing the
excessive parenthesis and not adding any semi-colon.
Original patch sign-off :
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
arch/ia64/kernel/entry.h | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 15:41:26 +0000 (16:41 +0100)]
[PATCH] reiserfs parenthesis fix
Hello,
This patch fixes parenthesis in B_PRIGHT_DELIM_KEY() macro code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
include/linux/reiserfs_fs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 15:39:08 +0000 (16:39 +0100)]
[PATCH] byteorder swab parenthesis fix
Hello,
This patch fixes byteorder swab 24 macro parenthesis.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
include/linux/byteorder/swab.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 15:36:42 +0000 (16:36 +0100)]
[PATCH] sparc64 dma parenthesis fixes
Hello,
This patch fixes some sparc64 dma macros.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
include/asm-sparc64/dma.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 15:33:50 +0000 (16:33 +0100)]
[PATCH] ppc ppc4xx_dma parenthesis fix
Hello,
This patch adds missing parenthesis in DMA_DEC macro code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
include/asm-ppc/ppc4xx_dma.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 15:31:27 +0000 (16:31 +0100)]
[PATCH] ppc m48t35 parenthesis fix
Hello,
This patch adds missing parenthesis.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
include/asm-ppc/m48t35.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 15:28:44 +0000 (16:28 +0100)]
[PATCH] parisc pdc parenthesis fix
Hello,
This patch fixes removes an extra parenthesis in PAT_GET_MOD_PAGES() macro code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
include/asm-parisc/pdc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 15:26:27 +0000 (16:26 +0100)]
[PATCH] mips64 klconfig parenthesis fix
Hello,
This patch fixes parenthesis stuff in PTR_CH_MALLOC_HDR() macro code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
include/asm-mips64/sn/klconfig.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 15:24:20 +0000 (16:24 +0100)]
[PATCH] mips/mips64 mv64340 parenthesis fixes
Hello,
This patch fixes parenthesis mv64340 stuff in both mips and mips64 code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
include/asm-mips/mv64340.h | 2 +-
include/asm-mips64/mv64340.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 15:21:12 +0000 (16:21 +0100)]
[PATCH] arm sa1100 parenthesis fix
Hello,
This patch fixes parenthesis stuff.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
include/asm-arm/arch-sa1100/SA-1101.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 15:19:04 +0000 (16:19 +0100)]
[PATCH] fs ufs macro parenthesis fix
Hello,
This patch fixes parenthesis stuff in ubh_get_addr16() macro code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
fs/ufs/util.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 15:16:21 +0000 (16:16 +0100)]
[PATCH] video sis parenthesis fix
Hello,
This patch removes an extra parenthesis in SetOEMLCDData() code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
drivers/video/sis/init301.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 15:14:18 +0000 (16:14 +0100)]
[PATCH] video pm3fb parenthesis fix
Hello,
This patch fixes parenthesis stuff.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
drivers/video/pm3fb.h | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 14:52:13 +0000 (15:52 +0100)]
[PATCH] scsi aic7xxx parenthesis fix
Hello,
This patch adds missing parenthesis.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
drivers/scsi/aic7xxx/aic79xx_pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 14:47:14 +0000 (15:47 +0100)]
[PATCH] scsi 53c7xx parenthesis fix
Hello,
Tis patch removes an extra parenthesis in abort_connected() code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
drivers/scsi/53c7xx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 14:44:56 +0000 (15:44 +0100)]
[PATCH] scsi 53c7,8xx parenthesis fix
Hello,
This patch removes an extra parenthesis in debugger_fn_bs() code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
drivers/scsi/53c7,8xx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 14:40:53 +0000 (15:40 +0100)]
[PATCH] net wavelan parenthesis fix
Hello,
This patch adds missing parenthesis in wavelan_ioctl() code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
drivers/net/wavelan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 14:38:11 +0000 (15:38 +0100)]
[PATCH] message fusion parenthesis fix
Hello,
This patch removes an extra parenthesis in mptscsih_abort() code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
drivers/message/fusion/mptscsih.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 14:33:04 +0000 (15:33 +0100)]
[PATCH] ide serverworks parenthesis fix
Hello,
This code is '#if 0'ed but hell ... while I'm at it I can fix it :-]
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
drivers/ide/pci/serverworks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 14:30:05 +0000 (15:30 +0100)]
[PATCH] ide legacy hd parenthesis fix
Hello,
This patch removes an extra parenthesis from read_intr() debug code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
drivers/ide/legacy/hd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 14:26:51 +0000 (15:26 +0100)]
[PATCH] serial_amba parenthesis fix
Hello,
This patch adds missing parenthesis in ambauart_modem_status() code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
drivers/char/serial_amba.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 14:24:49 +0000 (15:24 +0100)]
[PATCH] rio parenthesis fix
Hello,
This patch adds missing parenthesis in RIOMCAinit() code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
drivers/char/rio/rioinit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 14:21:32 +0000 (15:21 +0100)]
[PATCH] amijoy joystick parenthesis fix
Hello,
This patch adds missing parenthesis in amijoy_interrupt() code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
drivers/char/joystick/amijoy.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 14:19:07 +0000 (15:19 +0100)]
[PATCH] add missing parenthesis in pci-v320usc
Hello,
This patch adds missing parenthesis in v320usc_inb() macro.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
arch/sh/kernel/pci-v320usc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Mariusz Kozlowski [Fri, 1 Dec 2006 14:10:57 +0000 (15:10 +0100)]
[PATCH] arm: dma-arc add missing parenthesis
Hello,
This patch adds missing parenthesis in arc_floppy_data_enable_dma() code.
Signed-off-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
arch/arm/kernel/dma-arc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Andrzej Stypula [Sat, 20 Jan 2007 12:44:43 +0000 (13:44 +0100)]
[PATCH] fix build of serial with DEBUG enabled
This patch corrects define statement and variable name. Without this
patch is impossible to compile the serial driver with debug information.
This is probably copy/paste mistake from 2.2 or whatever.
Andrzej Stypula [Tue, 16 Jan 2007 11:44:55 +0000 (12:44 +0100)]
[PATCH] fix channel balance on TV cards with LG head
This patch corrects channel balance in TV cards with LG head, without
this one channel is almost off (I have this TV card). This one is
already fixed in 2.6.
Gilles Espinasse [Mon, 12 Feb 2007 23:02:09 +0000 (00:02 +0100)]
[PATCH] usb-storage: HP-FDC-GOLD need US_FL_SINGLE_LUN
I wanted to make my USB floppy work on 2.4.
I added USB FDC GOLD-1.11 that needs US_FL_SINGLE_LUN
Gilles Espinasse [Mon, 12 Feb 2007 23:01:47 +0000 (00:01 +0100)]
[PATCH] usb-storage: backport unusual_devs from 2.6.20
Backport unusual devices from 2.6.20, only those with flags known in 2.4 :
NEC USB UF000x, FDC GOLD-2.30, NIKON DSC D70, NIKON DSC D70s,
Epson 875DC Storage, Sony DSC-T1/T5/H5, Sony Handycam,
Sony PEG Mass Storage, SAMSUNG SFD-321U [FW 0C], Apple iPod,
Thomson Multimedia Inc. RCA RD1080 MP3 Player,
Freecom Technologies FHD-Classic, DataFab Systems Inc. USB CF+MS,
CITIZEN X1DE-USB, Acomdata CF, Acomdata CM, Unknown 0x0c45, 0x1060,
Sony Ericsson P990i, Sony Ericsson M600i, Minolta Dimage Z10
Devices with those flags unknown in 2.4 were not backported :
CONFIG_USB_STORAGE_ONETOUCH, US_FL_BULK32, US_FL_GO_SLOW,
US_FL_IGNORE_DEVICE, US_FL_IGNORE_RESIDUE, US_FL_MAX_SECTORS_64,
US_FL_NEED_OVERRIDE, US_FL_NOT_LOCKABLE, US_FL_NO_WP_DETECT,
US_PR_ALAUDA, US_PR_KARMA, US_PR_USBAT
Update those devices :
- Mitsumi FDD modified in 2.6.19
https://lists.one-eyed-alien.net/pipermail/usb-storage/2006-November/002722.html
Keep those devices blacklisted in 2.4 although they were removed in 2.6 :
- LaCie USB Hard Disk
https://lists.one-eyed-alien.net/pipermail/usb-storage/2006-August/002608.html
- Flashgate Hagiwara 0x0693, 0x0002, 0x0100, 0x0100
http://www.ussg.iu.edu/hypermail/linux/kernel/0510.3/2104.html
- IBM USB Memory Key 0x0a16, 0x8888, 0x0100, 0x0100
http://www.kernel.org/pub/linux/kernel/people/gregkh/usb/2.5/usb-storage-04-2.5.73.patch
Pete Zaitcev [Sun, 25 Feb 2007 03:51:17 +0000 (19:51 -0800)]
[PATCH] usb 2.4: Support high-speed HID
Fix high-speed HID. According to Stuart:
The problem is that the usbhid driver (in hid-core.c) is _not_ modifying
the interrupt URB interval for high speed devices before calling
FILL_INT_URB, which causes the interval to be too low, and the ehci
driver won't schedule the URB.
Specifically this was seen with a new USB 2.0 Avocent KVM dongle.
Signed-off-by: Pete Zaitcev <zaitcev@redhat.com>
Willy Tarreau [Sat, 10 Feb 2007 16:16:04 +0000 (17:16 +0100)]
Change VERSION to 2.4.35-pre1
- [NET] ethernet: Fix first packet goes out with MAC 00:00:00:00:00:00
- smbfs: fix problems introduced by last security backport
- e1000: integrate latest 2.4 linux driver
- [MAINTAINERS]: update e1000 maintainers
- e1000: update README
- proper locking on disconnect for mdc800
- merge 2.6 backport of skge/sky2 network drivers
- Merge branch 'skge'
Jesse Brandeburg [Tue, 6 Feb 2007 00:56:59 +0000 (16:56 -0800)]
e1000: update README
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Jesse Brandeburg [Tue, 6 Feb 2007 00:56:54 +0000 (16:56 -0800)]
[MAINTAINERS]: update e1000 maintainers
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Jesse Brandeburg [Tue, 6 Feb 2007 00:56:43 +0000 (16:56 -0800)]
e1000: integrate latest 2.4 linux driver
This updates the e1000 driver to our out-of-tree equivalent of 7.3.20.
This adds support for several new pieces of e100 hardware, including
quad-port 82571's (copper only), integrated nics of ICH8. The patch
includes dynamic interrupt support, many rewrites of subcomponents such
as wol enabling, manageability handling, shutdown/reset race fixes,
To keep the difference with the 2.6-version of this driver minimal
(which will facilitate future updates) we include a small compatibility
layer exclusively for e1000.
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Willy Tarreau [Sat, 3 Feb 2007 22:00:54 +0000 (23:00 +0100)]
Merge branch 'skge'
Willy Tarreau [Sat, 3 Feb 2007 21:56:26 +0000 (22:56 +0100)]
[PATCH] merge 2.6 backport of skge/sky2 network drivers
Quite a bunch of x86 motherboards equipped with a Gigabit LAN
port make use of a Marvell chip which requires the vendor's driver
from www.marvell.com. This driver is known to have some troubles,
among which losing frames under UDP-only trafic such as NFS and
DNS.
Stephen Hemminger has rewritten two separate drivers from scratch
for those chips to solve many problems in the historical driver.
A backport of his work is provided here as an alternate driver
for people experiencing problems with the vendor's one.
Current versions (skge-1.6 and sky2-1.5) do not support NAPI and
as such, consume slightly more CPU than the vendor's driver, but
at least they do seem to work correctly on UP. No test has been
performed on SMP yet.
Signed-off-by: Willy Tarreau <w@1wt.eu>
Christian Praehauser [Fri, 12 Jan 2007 13:32:25 +0000 (14:32 +0100)]
[NET] ethernet: Fix first packet goes out with MAC 00:00:00:00:00:00
This is a backport of a patch which was first included in Linux 2.6.16-rc5.
What follows between the "======" markers is the original description.
======
When you turn off ARP on a netdevice then the first packet always goes
out with a dstMAC of all zeroes. This is because the first packet is
used to resolve ARP entries. Even though the ARP entry may be resolved
(I tried by setting a static ARP entry for a host i was pinging from),
it gets overwritten by virtue of having the netdevice disabling ARP.
Subsequent packets go out fine with correct dstMAC address (which may
be why people have ignored reporting this issue).
To cut the story short:
the culprit code is in net/ethernet/eth.c::eth_header()
----
/*
* Anyway, the loopback-device should never use this function...
*/
if (dev->flags & (IFF_LOOPBACK|IFF_NOARP))
{
memset(eth->h_dest, 0, dev->addr_len);
return ETH_HLEN;
}
if(daddr)
{
memcpy(eth->h_dest,daddr,dev->addr_len);
return ETH_HLEN;
}
----
Note how the h_dest is being reset when device has IFF_NOARP.
As a note:
All devices including loopback pass a daddr. loopback in fact passes
a 0 all the time ;->
This means i can delete the check totaly or i can remove the IFF_NOARP
Alexey says:
--------------------
I think, it was me who did this crap. It was so long ago I do not remember
why it was made.
I remember some troubles with dummy device. It tried to resolve
addresses, apparently, without success and generated errors instead of
blackholing. I think the problem was eventually solved at neighbour
level.
After some thinking I suspect the deletion of this chunk could change
behaviour of some parts which do not use neighbour cache f.e. packet
socket.
I think safer approach would be to move this chunk after if (daddr).
And the possibility to remove this completely could be analyzed later.
--------------------
Patch updated with Alexey's safer suggestions.
Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
Acked-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
======
This problem also arises when transmitting IP multicast packets. If you send an
IP multicast stream over an ethernet network interface ethX and turn off ARP on
ethX then Linux will produce an ethernet frame with a dest. addresses of
00:00:00:00:00:00 (which is invalid). As IP multicast addresses are directly
mapped to HW (MAC) addresses without invoking any ARP protocol mechanisms - for
IP4 this mapping is performed by the function ip_eth_mc_map - it makes perfect
sense to do this even if ARP is disabled. Further, this problem may occur
periodically, everytime the corresponding struct dst_entry is garbage-collected
(e.g. ~ every 10 minutes).
Patch ported to Linux 2.4 by Christian Praehauser.
Signed-off-by: Christian Praehauser <cpraehaus@cosy.sbg.ac.at>
Oliver Neukum [Fri, 5 Jan 2007 16:40:48 +0000 (17:40 +0100)]
[PATCH] proper locking on disconnect for mdc800
this makes mdc800 take the necessary lock in disconnect() to prevent
submission of an URB for a disconnected device.
Signed-off-by: Oliver Neukum <oliver@neukum.name>
dann frazier [Tue, 23 Jan 2007 21:12:57 +0000 (14:12 -0700)]
[PATCH] smbfs: fix problems introduced by last security backport
Users have reported a symlink issue with my recent smbfs backport.
Turns out my backport overlooked a second 2.6 patch w/ the fix:
http://linux.bkbits.net:8080/linux-2.6/?PAGE=cset&REV=419e7b76CdrmRG_NZ8LKj9DUUBGu1w
This is a backport of Haroldo Gamal's 2.6 patch that fixes the symlink
issue, and also cleans up an unnecessary double assignment. As his
commit message notes, you will need the userspace patches from Samba
Bug #999 in order to use the permission/ownership assigned by the
server.
Signed-off-by: dann frazier <dannf@debian.org>
Willy Tarreau [Sat, 23 Dec 2006 20:34:20 +0000 (21:34 +0100)]
Change VERSION to 2.4.34
Willy Tarreau [Fri, 22 Dec 2006 22:00:32 +0000 (23:00 +0100)]
Change VERSION to 2.4.34-rc4
- Call init_timer() for ISDN PPP CCP reset state timer (CVE-2006-5749)
Marcel Holtmann [Tue, 19 Dec 2006 22:51:24 +0000 (23:51 +0100)]
[PATCH] Call init_timer() for ISDN PPP CCP reset state timer (CVE-2006-5749)
The function isdn_ppp_ccp_reset_alloc_state() sets ->timer.function
and ->timer.data and later on calls add_timer() with no init_timer()
ever done. The call of init_timer() is needed, because otherwise the
call of add_timer() will result in an instant death.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Willy Tarreau [Mon, 18 Dec 2006 08:32:18 +0000 (09:32 +0100)]
Change VERSION to 2.4.34-rc3
- zeromap may find a pte
- Fix incorrect user space access locking in mincore() (CVE-2006-4814)
Linus Torvalds [Sun, 17 Dec 2006 14:38:15 +0000 (14:38 +0000)]
[PATCH] Fix incorrect user space access locking in mincore() (CVE-2006-4814)
Fix incorrect user space access locking in mincore()
Doug Chapman noticed that mincore() will do a "copy_to_user()" of the
result while holding the mmap semaphore for reading, which is a big
no-no. While a recursive read-lock on a semaphore in the case of a page
fault happens to work, we don't actually allow them due to deadlock
scenarios with writers due to fairness issues.
Doug and Marcel sent in a patch to fix it, but I decided to just rewrite
the mess instead - not just fixing the locking problem, but making the
code smaller and (imho) much easier to understand.
Hugh "ported" it to 2.4:
please note two slight changes to behaviour under error conditions:
(a) mincore used to report -EINVAL if input len was so big that the
given area wrapped: that shouldn't be a distinct case from crossing
a hole in the address space, 2.6.11 corrected the error to -ENOMEM,
and this patch extends that correction to 2.4.
(b) mincore used to report -ENOMEM if the given area crossed a hole
in the address space, but continued to fill in the vector for file-
backed regions above - yet didn't fill the vector with non-present
entries for the hole, just ignored it. This patch continues to
report -ENOMEM if the given area crosses a hole in the address
space, but simply stops filling the vector at that point. We
doubt any app could be relying on the previous weird behaviour.
Cc: Doug Chapman <dchapman@redhat.com>
Cc: Marcel Holtmann <holtmann@redhat.com>
Cc: Hugh Dickins <hugh@veritas.com>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Hugh Dickins [Sat, 16 Dec 2006 19:59:23 +0000 (19:59 +0000)]
[PATCH] zeromap may find a pte
Ramiro Voicu hit 2.6's BUG_ON(!pte_none(*pte)) in zeromap_pte_range:
kernel bugzilla 7645. Right: read_zero_pagealigned uses down_read of
mmap_sem, but another thread's racing read of /dev/zero, or a normal
fault, can easily set that pte again, in between zap_page_range and
zeromap_page_range getting there. It's been wrong ever since 2.4.3.
The simple fix is to use down_write instead, but that would serialize
reads of /dev/zero more than at present: perhaps some app would be
badly affected. So instead let zeromap_page_range return the error
instead of BUG in forget_pte, and read_zero_pagealigned break to the
slower clear_user loop in that case - no need to optimize for it.
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Willy Tarreau [Thu, 14 Dec 2006 15:30:27 +0000 (16:30 +0100)]
Change VERSION to 2.4.34-rc2
- [Bluetooth] Add packet size checks for CAPI messages (CVE-2006-6106)
Marcel Holtmann [Thu, 14 Dec 2006 12:53:31 +0000 (13:53 +0100)]
[PATCH] [Bluetooth] Add packet size checks for CAPI messages (CVE-2006-6106)
With malformed packets it might be possible to overwrite internal
CMTP and CAPI data structures. This patch adds additional length
checks to prevent these kinds of remote attacks.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Willy Tarreau [Tue, 5 Dec 2006 13:48:17 +0000 (14:48 +0100)]
Change VERSION to 2.4.34-rc1
- smbfs : don't ignore uid/gid/mode mount opts w/ unix extensions (CVE-2006-5871)
- i2c cleanup : several cleanups
- fix for transient error in usb printer driver
- task stte leak in pegasus usb driver
- Masking bug in 6pack driver
- x86 microcode: dont check the size
- rio: typo in bitwise AND expression.
- flashpoint: use '!' instead of '~' with EE_SYNC_MASK
- jfs: incorrect use of "&&" instead of "&"
- arm: incorrect use of "&&" instead of "&"
- e100: incorrect use of "&&" instead of "&"
- ps2esdi: typo may cause premature timeout
- fbcon: incorrect use of "&&" instead of "&"
dann frazier [Tue, 5 Dec 2006 05:57:37 +0000 (22:57 -0700)]
[PATCH] smbfs : don't ignore uid/gid/mode mount opts w/ unix extensions
smbfs in 2.4 currently ignores the uid, gid & mode mount options if
unix extensions are enabled. Here is a backport of Haroldo Gamal's 2.6 fix for
Debian's 2.4.27 kernel that should apply cleanly to latest 2.4 git.
This issue has been assigned CVE-2006-5871.
Signed-off-by: dann frazier <dannf@debian.org>
Oliver Neukum [Sun, 3 Dec 2006 22:22:24 +0000 (23:22 +0100)]
[PATCH] task stte leak in pegasus usb driver
Hi,
this is a conservative port of a 2.6 fix for the pegasus driver which leaks
TASK_UNINTERRUPTIBLE in error cases. In case of an error the state
needs to be reset to TASK_RUNNING.
Regards
Oliver
Signed-off-by: Oliver Neukum <oliver@neukum.name>
Acked-by: Petko Manolov <petkan@nucleusys.com>
Shaohua Li [Wed, 29 Nov 2006 22:00:25 +0000 (14:00 -0800)]
[PATCH] x86 microcode: dont check the size
(backported from 2.6)
IA32 manual says if micorcode update's size is 0, then the size is
default size (2048 bytes). But this doesn't suggest all microcode
update's size should be above 2048 bytes to me. We actually had a
microcode update whose size is 1024 bytes. The patch just removed the
check.
Backported to 2.6.18 by Daniel Drake.
Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Acked-by: Shaohua Li <shaohua.li@intel.com>