24 Mar, 2006

2 commits


09 Mar, 2006

1 commit

  • A recent change to compat. dev_ifconf() in fs/compat_ioctl.c
    causes ifconf data to be truncated 1 entry too early when copying it
    to userspace. The correct amount of data (length) is returned,
    but the final entry is empty (zero, not filled in).
    The for-loop 'i' check should use
    Signed-off-by: David S. Miller

    Randy Dunlap
     

27 Feb, 2006

1 commit


08 Feb, 2006

1 commit


13 Jan, 2006

1 commit


12 Jan, 2006

2 commits


11 Jan, 2006

2 commits

  • Now that all these entries in the arch ioctl32.c files are gone [1], we can
    build fs/compat_ioctl.c as a normal object and kill tons of cruft. We need a
    special do_ioctl32_pointer handler for s390 so the compat_ptr call is done.
    This is not needed but harmless on all other architectures. Also remove some
    superflous includes in fs/compat_ioctl.c

    Tested on ppc64.

    [1] parisc still had it's PPP handler left, which is not fully correct
    for ppp and besides that ppp uses the generic SIOCPRIV ioctl so it'd
    kick in for all netdevice users. We can introduce a proper handler
    in one of the next patch series by adding a compat_ioctl method to
    struct net_device but for now let's just kill it - parisc doesn't
    compile in mainline anyway and I don't want this to block this
    patchset.

    Signed-off-by: Christoph Hellwig
    Cc: Matthew Wilcox
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Christoph Hellwig
     
  • This patch implements generic handling of RTC_IRQP_READ32, RTC_IRQP_SET32,
    RTC_EPOCH_READ32 and RTC_EPOCH_SET32 in fs/compat_ioctl.c. It's based on the
    x86_64 code which needed a little massaging to be endian-clean.

    parisc used COMPAT_IOCTL or generic w_long handlers for these whichce is wrong
    and can't work because the ioctls encode sizeof(unsigned long) in their ioctl
    number. parisc also duplicated COMPAT_IOCTL entries for other rtc ioctls
    which I remove in this patch, too.

    Signed-off-by: Christoph Hellwig
    Acked-by: Matthew Wilcox
    Acked-by: "David S. Miller"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Christoph Hellwig
     

10 Jan, 2006

1 commit

  • This moves the 32 bit ioctl compatibility handlers for
    Video4Linux into a new file and adds explicit calls to them
    to each v4l device driver.

    Unfortunately, there does not seem to be any code handling
    the v4l2 ioctls, so quite often the code goes through two
    separate conversions, first from 32 bit v4l to 64 bit v4l,
    and from there to 64 bit v4l2. My patch does not change
    that, so there is still much room for improvement.

    Also, some drivers have additional ioctl numbers, for
    which the conversion should be handled internally to
    that driver.

    Signed-off-by: Arnd Bergmann
    Signed-off-by: Mauro Carvalho Chehab

    Arnd Bergmann
     

21 Nov, 2005

1 commit

  • From: Alexandra Kossovsky

    From http://bugzilla.kernel.org/show_bug.cgi?id=4746

    There is user data corruption when using ioctl(SIOCGIFCONF) in 32-bit
    application running amd64 kernel. I do not think that this problem is
    exploitable, but any data corruption may lead to security problems.
    Following code demonstrates the problem

    #include
    #include
    #include
    #include
    #include
    #include

    char buf[256];

    main()
    {
    int s = socket(AF_INET, SOCK_DGRAM, 0);
    struct ifconf req;
    int i;

    req.ifc_buf = buf;
    req.ifc_len = 41;

    printf("Result %d\n", ioctl(s, SIOCGIFCONF, &req));
    printf("Len %d\n", req.ifc_len);
    for (i = 41; i < 256; i++)
    if (buf[i] != 0)
    printf("Byte %d is corrupted\n", i);
    }

    Steps to reproduce:
    Compile the code above into 32-bit elf and run it. You'll get
    Result 0
    Len 32
    Byte 48 is corrupted
    Byte 52 is corrupted
    Byte 53 is corrupted
    Byte 54 is corrupted
    Byte 55 is corrupted

    Signed-off-by: Andrew Morton
    Signed-off-by: David S. Miller

    Alexandra Kossovsky
     

19 Nov, 2005

1 commit


18 Nov, 2005

1 commit


16 Nov, 2005

1 commit


09 Nov, 2005

2 commits


07 Nov, 2005

1 commit

  • This is the fs/ part of the big kfree cleanup patch.

    Remove pointless checks for NULL prior to calling kfree() in fs/.

    Signed-off-by: Jesper Juhl
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jesper Juhl
     

31 Oct, 2005

1 commit

  • TIOCSTART and TIOCSTOP are defined in asm/ioctls.h and asm/termios.h by
    various architectures but not actually implemented anywhere but in the IRIX
    compatibility layer, so remove their COMPATIBLE_IOCTL from parisc, ppc64
    and sparc64.

    Move the TIOCSLTC COMPATIBLE_IOCTL to common code, guided by an ifdef to
    only show up on architectures that support it (same as the code handling it
    in tty_ioctl.c), aswell as it's brother TIOCGLTC that wasn't handled so
    far.

    Signed-off-by: Christoph Hellwig
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Christoph Hellwig
     

29 Oct, 2005

1 commit

  • Dell supplied me with the following test:

    #include
    #include
    #include
    #include
    #include

    main(int argc,char*argv[])
    {
    struct usbdevfs_hub_portinfo hubPortInfo = {0};
    struct usbdevfs_ioctl command = {0};
    command.ifno = 0;
    command.ioctl_code = USBDEVFS_HUB_PORTINFO;
    command.data = (void*)&hubPortInfo;
    int fd, ret;
    if(argc != 2) {
    fprintf(stderr,"Usage: %s /proc/bus/usb//\n",argv[0]);
    fprintf(stderr,"Example: %s /proc/bus/usb/001/001\n",argv[0]);
    exit(1);
    }
    errno = 0;
    fd = open(argv[1],O_RDWR);
    if(fd < 0) {
    perror("open failed:");
    exit(errno);
    }
    errno = 0;
    ret = ioctl(fd,USBDEVFS_IOCTL,&command);
    printf("IOCTL return status:%d\n",ret);
    if(ret
    Signed-off-by: Greg Kroah-Hartman

    Pete Zaitcev
     

10 Sep, 2005

1 commit


17 Apr, 2005

1 commit

  • Initial git repository build. I'm not bothering with the full history,
    even though we have it. We can create a separate "historical" git
    archive of that later if we want to, and in the meantime it's about
    3.2GB when imported into git - space that would just make the early
    git days unnecessarily complicated, when we don't have a lot of good
    infrastructure for it.

    Let it rip!

    Linus Torvalds