Skip to content
  1. Mar 13, 2013
  2. Mar 12, 2013
    • Al Viro's avatar
      vfs: fix pipe counter breakage · a930d879
      Al Viro authored
      
      
      If you open a pipe for neither read nor write, the pipe code will not
      add any usage counters to the pipe, causing the 'struct pipe_inode_info"
      to be potentially released early.
      
      That doesn't normally matter, since you cannot actually use the pipe,
      but the pipe release code - particularly fasync handling - still expects
      the actual pipe infrastructure to all be there.  And rather than adding
      NULL pointer checks, let's just disallow this case, the same way we
      already do for the named pipe ("fifo") case.
      
      This is ancient going back to pre-2.4 days, and until trinity, nobody
      naver noticed.
      
      Reported-by: default avatarDave Jones <davej@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a930d879
  3. Mar 11, 2013
  4. Mar 10, 2013
    • Mathias Krause's avatar
      dcbnl: fix various netlink info leaks · 29cd8ae0
      Mathias Krause authored
      
      
      The dcb netlink interface leaks stack memory in various places:
      * perm_addr[] buffer is only filled at max with 12 of the 32 bytes but
        copied completely,
      * no in-kernel driver fills all fields of an IEEE 802.1Qaz subcommand,
        so we're leaking up to 58 bytes for ieee_ets structs, up to 136 bytes
        for ieee_pfc structs, etc.,
      * the same is true for CEE -- no in-kernel driver fills the whole
        struct,
      
      Prevent all of the above stack info leaks by properly initializing the
      buffers/structures involved.
      
      Signed-off-by: default avatarMathias Krause <minipli@googlemail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      29cd8ae0
    • Mathias Krause's avatar
      rtnl: fix info leak on RTM_GETLINK request for VF devices · 84d73cd3
      Mathias Krause authored
      
      
      Initialize the mac address buffer with 0 as the driver specific function
      will probably not fill the whole buffer. In fact, all in-kernel drivers
      fill only ETH_ALEN of the MAX_ADDR_LEN bytes, i.e. 6 of the 32 possible
      bytes. Therefore we currently leak 26 bytes of stack memory to userland
      via the netlink interface.
      
      Signed-off-by: default avatarMathias Krause <minipli@googlemail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      84d73cd3
    • Mathias Krause's avatar
      bridge: fix mdb info leaks · c085c499
      Mathias Krause authored
      
      
      The bridging code discloses heap and stack bytes via the RTM_GETMDB
      netlink interface and via the notify messages send to group RTNLGRP_MDB
      afer a successful add/del.
      
      Fix both cases by initializing all unset members/padding bytes with
      memset(0).
      
      Cc: Stephen Hemminger <stephen@networkplumber.org>
      Signed-off-by: default avatarMathias Krause <minipli@googlemail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c085c499
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace · 72932611
      Linus Torvalds authored
      Pull namespace bugfixes from Eric Biederman:
       "This is three simple fixes against 3.9-rc1.  I have tested each of
        these fixes and verified they work correctly.
      
        The userns oops in key_change_session_keyring and the BUG_ON triggered
        by proc_ns_follow_link were found by Dave Jones.
      
        I am including the enhancement for mount to only trigger requests of
        filesystem modules here instead of delaying this for the 3.10 merge
        window because it is both trivial and the kind of change that tends to
        bit-rot if left untouched for two months."
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
        proc: Use nd_jump_link in proc_ns_follow_link
        fs: Limit sys_mount to only request filesystem modules (Part 2).
        fs: Limit sys_mount to only request filesystem modules.
        userns: Stop oopsing in key_change_session_keyring
      72932611
    • Stephan Frank's avatar
      Input: wacom - add support for 0x10d · 58694837
      Stephan Frank authored
      
      
      It is a Wacom device found in Fujitsu Lifebook T902.
      
      Signed-off-by: default avatarStephan Frank <sfrank@cs.tu-berlin.de>
      Acked-by: default avatarPing Cheng <pingc@wacom.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      58694837
    • Linus Torvalds's avatar
      Atmel MXT touchscreen: increase reset timeouts · 8343bce1
      Linus Torvalds authored
      
      
      There is a more complete atmel patch-series out by Nick Dyer that fixes
      this and other things, but in the meantime this is the minimal thing to
      get the touchscreen going on (at least my) Pixel Chromebook.
      
      Not that I want my dirty fingers near that beautiful screen, but it
      seems that a non-initialized touchscreen will also end up being a
      constant wakeup source, so you have to disable it to go to sleep.  And
      it's easier to just fix the initialization sequence.
      
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8343bce1
    • J. Bruce Fields's avatar
      sunrpc: don't attempt to cancel unitialized work · 190b1ecf
      J. Bruce Fields authored
      As of dc107402
      
       "SUNRPC: make AF_LOCAL connect synchronous", we no longer initialize connect_worker in the
      AF_LOCAL case, resulting in warnings like:
      
          WARNING: at lib/debugobjects.c:261 debug_print_object+0x8c/0xb0() Hardware name: Bochs
          ODEBUG: assert_init not available (active state 0) object type: timer_list hint: stub_timer+0x0/0x20
          Modules linked in: iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi nfsd auth_rpcgss nfs_acl lockd sunrpc
          Pid: 4816, comm: nfsd Tainted: G        W    3.8.0-rc2-00049-gdc10740 #801
          Call Trace:
           [<ffffffff8156ec00>] ? free_obj_work+0x60/0xa0
           [<ffffffff81046aaf>] warn_slowpath_common+0x7f/0xc0
           [<ffffffff81046ba6>] warn_slowpath_fmt+0x46/0x50
           [<ffffffff8156eccc>] debug_print_object+0x8c/0xb0
           [<ffffffff81055030>] ? timer_debug_hint+0x10/0x10
           [<ffffffff8156f7e3>] debug_object_assert_init+0xe3/0x120
           [<ffffffff81057ebb>] del_timer+0x2b/0x80
           [<ffffffff8109c4e6>] ? mark_held_locks+0x86/0x110
           [<ffffffff81065a29>] try_to_grab_pending+0xd9/0x150
           [<ffffffff81065b57>] __cancel_work_timer+0x27/0xc0
           [<ffffffff81065c03>] cancel_delayed_work_sync+0x13/0x20
           [<ffffffffa0007067>] xs_destroy+0x27/0x80 [sunrpc]
           [<ffffffffa00040d8>] xprt_destroy+0x78/0xa0 [sunrpc]
           [<ffffffffa0006241>] xprt_put+0x21/0x30 [sunrpc]
           [<ffffffffa00030cf>] rpc_free_client+0x10f/0x1a0 [sunrpc]
           [<ffffffffa0002ff3>] ? rpc_free_client+0x33/0x1a0 [sunrpc]
           [<ffffffffa0002f7e>] rpc_release_client+0x6e/0xb0 [sunrpc]
           [<ffffffffa000325d>] rpc_shutdown_client+0xfd/0x1b0 [sunrpc]
           [<ffffffffa0017196>] rpcb_put_local+0x106/0x130 [sunrpc]
          ...
      
      Acked-by: default avatar"Myklebust, Trond" <Trond.Myklebust@netapp.com>
      Signed-off-by: default avatarJ. Bruce Fields <bfields@redhat.com>
      190b1ecf
  5. Mar 09, 2013