linux-stable.git/arch/alpha/kernel/osf_sys.c, branch linux-2.6.27.y

alpha: fix several security issues

2012-02-11T14:37:38+00:00

commit 21c5977a836e399fc710ff2c5367845ed5c2527f upstream.

Fix several security issues in Alpha-specific syscalls.  Untested, but
mostly trivial.

1. Signedness issue in osf_getdomainname allows copying out-of-bounds
kernel memory to userland.

2. Signedness issue in osf_sysinfo allows copying large amounts of
kernel memory to userland.

3. Typo (?) in osf_getsysinfo bounds minimum instead of maximum copy
size, allowing copying large amounts of kernel memory to userland.

4. Usage of user pointer in osf_wait4 while under KERNEL_DS allows
privilege escalation via writing return value of sys_wait4 to kernel
memory.

Signed-off-by: Dan Rosenberg 
Cc: Richard Henderson 
Cc: Ivan Kokshaysky 
Cc: Matt Turner 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Willy Tarreau

[PATCH] fix osf_getdirents()

2008-08-25T05:18:06+00:00

Return value of filldir callback is just "should we stop here"; it's
not a usable channel for passing error values (i.e. ->readdir() will
forget anything except "is it non-zero").

Signed-off-by: Al Viro

[PATCH] sanitize __user_walk_fd() et.al.

2008-07-27T00:53:34+00:00

* do not pass nameidata; struct path is all the callers want.
* switch to new helpers:
	user_path_at(dfd, pathname, flags, &path)
	user_path(pathname, &path)
	user_lpath(pathname, &path)
	user_path_dir(pathname, &path)  (fail if not a directory)
  The last 3 are trivial macro wrappers for the first one.
* remove nameidata in callers.

Signed-off-by: Al Viro

[PATCH] make osf_select() use core_sys_select()

2008-05-01T17:07:28+00:00

... instead of open-coding it

Signed-off-by: Al Viro

alpha: unbreak OSF/1 (a.out) binaries

2008-04-24T15:35:47+00:00

OSF/1 brk(2) was broken by following one-liner in sys_brk()
(commit 4cc6028d4040f95cdb590a87db478b42b8be0508):

-	if (brk < mm->end_code)
+	if (brk < mm->start_brk)
		goto out;

The problem is that osf_set_program_attributes()
does update mm->end_code, but not mm->start_brk,
which still contains inappropriate value left from
binary loader, so brk() always fails.

Signed-off-by: Ivan Kokshaysky 
Signed-off-by: Linus Torvalds

Introduce path_put()

2008-02-15T05:13:33+00:00

* Add path_put() functions for releasing a reference to the dentry and
  vfsmount of a struct path in the right order

* Switch from path_release(nd) to path_put(&nd->path)

* Rename dput_path() to path_put_conditional()

[akpm@linux-foundation.org: fix cifs]
Signed-off-by: Jan Blunck 
Signed-off-by: Andreas Gruenbacher 
Acked-by: Christoph Hellwig 
Cc: 
Cc: Al Viro 
Cc: Steven French 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

Embed a struct path into struct nameidata instead of nd->{dentry,mnt}

2008-02-15T05:13:33+00:00

This is the central patch of a cleanup series. In most cases there is no good
reason why someone would want to use a dentry for itself. This series reflects
that fact and embeds a struct path into nameidata.

Together with the other patches of this series
- it enforced the correct order of getting/releasing the reference count on
   pairs
- it prepares the VFS for stacking support since it is essential to have a
  struct path in every place where the stack can be traversed
- it reduces the overall code size:

without patch series:
   text    data     bss     dec     hex filename
5321639  858418  715768 6895825  6938d1 vmlinux

with patch series:
   text    data     bss     dec     hex filename
5320026  858418  715768 6894212  693284 vmlinux

This patch:

Switch from nd->{dentry,mnt} to nd->path.{dentry,mnt} everywhere.

[akpm@linux-foundation.org: coding-style fixes]
[akpm@linux-foundation.org: fix cifs]
[akpm@linux-foundation.org: fix smack]
Signed-off-by: Jan Blunck 
Signed-off-by: Andreas Gruenbacher 
Acked-by: Christoph Hellwig 
Cc: Al Viro 
Cc: Casey Schaufler 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

aout: remove unnecessary inclusions of {asm, linux}/a.out.h

2008-02-08T17:22:30+00:00

Remove now unnecessary inclusions of {asm,linux}/a.out.h.

[akpm@linux-foundation.org: fix alpha build]
Signed-off-by: David Howells 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

get rid of NR_OPEN and introduce a sysctl_nr_open

2008-02-06T18:41:06+00:00

NR_OPEN (historically set to 1024*1024) actually forbids processes to open
more than 1024*1024 handles.

Unfortunatly some production servers hit the not so 'ridiculously high
value' of 1024*1024 file descriptors per process.

Changing NR_OPEN is not considered safe because of vmalloc space potential
exhaust.

This patch introduces a new sysctl (/proc/sys/fs/nr_open) wich defaults to
1024*1024, so that admins can decide to change this limit if their workload
needs it.

[akpm@linux-foundation.org: export it for sparc64]
Signed-off-by: Eric Dumazet 
Cc: Alan Cox 
Cc: Richard Henderson 
Cc: Ivan Kokshaysky 
Cc: "David S. Miller" 
Cc: Ralf Baechle 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

spelling fixes: arch/alpha/

2007-10-19T23:04:37+00:00

Spelling fixes in arch/alpha/.

Signed-off-by: Simon Arlott 
Signed-off-by: Adrian Bunk