commit 05dbb1e557b392c8cef3675b4ba6497794ad4124
Author: Chris Wright <chrisw@osdl.org>
Date: Fri Sep 9 19:42:58 2005 -0700
Linux 2.6.13.1
commit 0721a681c617fdd498f2f0f40e69895354baf099
Author: Al Viro <aviro@redhat.com>
Date: Wed Aug 31 10:55:12 2005 +0100
[PATCH] raw_sendmsg DoS (CAN-2005-2492)
Fix unchecked __get_user that could be tricked into generating a
memory read on an arbitrary address. The result of the read is not
returned directly but you may be able to divine some information about
it, or use the read to cause a crash on some architectures by reading
hardware state. CAN-2005-2492.
Fix from Al Viro, ack from Dave Miller.
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit c255cda2af84db91d19944c092baf5a61c633181
Author: David Woodhouse <dwmw2@infradead.org>
Date: Tue Sep 6 09:30:10 2005 +0100
[PATCH] 32bit sendmsg() flaw (CAN-2005-2490)
When we copy 32bit ->msg_control contents to kernel, we walk the same
userland data twice without sanity checks on the second pass.
Second version of this patch: the original broke with 64-bit arches
running 32-bit-compat-mode executables doing sendmsg() syscalls with
unaligned CMSG data areas
Another thing is that we use kmalloc() to allocate and sock_kfree_s()
to free afterwards; less serious, but also needs fixing.
Patch by Al Viro, David Miller, David Woodhouse
(sparc64 clean compile fix from David Miller)
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit cf43ea034180996242226eac042889c5b06c7df7
Author: Stephen Hemminger <shemminger@osdl.org>
Date: Tue Sep 6 15:52:34 2005 -0700
[PATCH] Reassembly trim not clearing CHECKSUM_HW
[IPV4]: Reassembly trim not clearing CHECKSUM_HW
This was found by inspection while looking for checksum problems
with the skge driver that sets CHECKSUM_HW. It did not fix the
problem, but it looks like it is needed.
If IP reassembly is trimming an overlapping fragment, it
should reset (or adjust) the hardware checksum flag on the skb.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 76739be851b4fd112f28dd7c2aaff136def09d64
Author: David S. Miller <davem@davemloft.net>
Date: Tue Sep 6 15:03:39 2005 -0700
[PATCH] Use SA_SHIRQ in sparc specific code.
Based upon a report from Jason Wever.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit e381a0a1169713ef4494d22693896e781b83fcbd
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date: Fri Sep 9 19:42:51 2005 -0700
[PATCH] Fix boundary check in standard multi-block cipher processors
[CRYPTO] Fix boundary check in standard multi-block cipher processors
Fixes Bug 5194 (IPSec related Oops in 2.6.13).
The boundary check in the standard multi-block cipher processors are
broken when nbytes is not a multiple of bsize. In those cases it will
always process an extra block.
This patch corrects the check so that it processes at most nbytes of data.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit a49567a4dbfd414f19e5bf828a4b2c540f164ea8
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date: Mon Sep 5 18:47:10 2005 -0700
[PATCH] 2.6.13 breaks libpcap (and tcpdump)
[NET]: 2.6.13 breaks libpcap (and tcpdump)
Patrick McHardy says:
Never mind, I got it, we never fall through to the second switch
statement anymore. I think we could simply break when load_pointer
returns NULL. The switch statement will fall through to the default
case and return 0 for all cases but 0 > k >= SKF_AD_OFF.
Here's a patch to do just that.
I left BPF_MSH alone because it's really a hack to calculate the IP
header length, which makes no sense when applied to the special data.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 2811d271ee67f4de6c6d7e2c731698f6f9f7746a
Author: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Date: Mon Sep 5 07:12:21 2005 -0700
[PATCH] x86: pci_assign_unassigned_resources() update
I had some time to think about PCI assign issues in 2.6.13-rc series.
The major problem here is that we call pci_assign_unassigned_resources()
way too early - at subsys_initcall level. Therefore we give no chances
to ACPI and PnP routines (called at fs_initcall level) to reserve their
respective resources properly, as the comments in drivers/pnp/system.c
and drivers/acpi/motherboard.c suggest:
/**
* Reserve motherboard resources after PCI claim BARs,
* but before PCI assign resources for uninitialized PCI devices
*/
So I moved the pci_assign_unassigned_resources() call to
pcibios_assign_resources() (fs_initcall), which should hopefully fix a
lot of problems and make PCIBIOS_MIN_IO tweaks unnecessary.
Other changes:
- remove resource assignment code from pcibios_assign_resources(), since
it duplicates pci_assign_unassigned_resources() functionality and
actually does nothing in 2.6.13;
- modify ROM assignment code as per Ben's suggestion: try to use firmware
settings by default (if PCI_ASSIGN_ROMS is not set);
- set CARDBUS_IO_SIZE back to 4K as it's a wonderful stress test for
various setups.
Confirmed by Tero Roponen <teanropo@cc.jyu.fi> (who had problems with
the 4kB CardBus IO size previously).
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 5163b0a323cf51f1bb322a37fd86d3433ffc9d4a
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date: Sun Sep 4 08:28:05 2005 +1000
[PATCH] Fix PCI ROM mapping
This fixes a problem with pci_map_rom() which doesn't properly
update the ROM BAR value with the address thas allocated for it by the
PCI code. This problem, among other, breaks boot on Mac laptops.
It'ss a new version based on Linus latest one with better error
checking.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 7a8ad840d817bda420f89963d9650a6f053eeea1
Author: Mark Haverkamp <markh@osdl.org>
Date: Thu Sep 1 08:19:23 2005 -0700
[PATCH] aacraid: 2.6.13 aacraid bad BUG_ON fix
This was noticed by Doug Bazamic and the fix found by Mark Salyzyn at
Adaptec.
There was an error in the BUG_ON() statement that validated the
calculated fib size which can cause the driver to panic.
Signed-off-by: Mark Haverkamp <markh@osdl.org>
Acked-by: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 6532533a281e5113d74cb403c256be1c6b446f1a
Author: Michael Krufky <mkrufky@m1k.net>
Date: Tue Aug 30 15:47:14 2005 -0400
[PATCH] Kconfig: saa7134-dvb must select tda1004x
I wish I had seen this before 2.6.13 was released... I guess this only
goes to show that there haven't been any testers using saa7134-hybrid
dvb/v4l boards that depend on the tda1004x module, during the 2.6.13-rc
series :-(
Please apply this to 2.6.14, and also to 2.6.13.1 -stable. Without this
patch, users will have to EXPLICITLY select tda1004x in Kconfig. This
SHOULD be done automatically when saa7134-dvb is selected. This patch
corrects this problem.
saa7134-dvb must select tda1004x
Signed-off-by: Michael Krufky <mkrufky@m1k.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>