linux-stable.git/drivers/block, branch linux-2.6.32.y

cciss: Fix misapplied "cciss: fix info leak in cciss_ioctl32_passthru()"

2014-12-13T14:16:20+00:00

Upstream commit 58f09e00ae09 was applied to the wrong function when
cherry-picked for 2.6.32.61.

Signed-off-by: Ben Hutchings 
Signed-off-by: Willy Tarreau

floppy: don't write kernel-only members to FDRAWCMD ioctl output

2014-05-19T05:54:39+00:00

Do not leak kernel-only floppy_raw_cmd structure members to userspace.
This includes the linked-list pointer and the pointer to the allocated
DMA space.

Signed-off-by: Matthew Daley 
Signed-off-by: Linus Torvalds 
(cherry picked from commit 2145e15e0557a01b9195d1c7199a1b92cb9be81f)
Signed-off-by: Willy Tarreau

floppy: ignore kernel-only members in FDRAWCMD ioctl input

2014-05-19T05:54:38+00:00

Always clear out these floppy_raw_cmd struct members after copying the
entire structure from userspace so that the in-kernel version is always
valid and never left in an interdeterminate state.

Signed-off-by: Matthew Daley 
Signed-off-by: Linus Torvalds 
(cherry picked from commit ef87dbe7614341c2e7bfe8d32fcb7028cc97442c)
[wt: be careful in 2.6.32 we still have the ugly macros everywhere]
Signed-off-by: Willy Tarreau

block: do not pass disk names as format strings

2014-05-19T05:53:26+00:00

commit ffc8b30866879ed9ba62bd0a86fecdbd51cd3d19 upstream

Disk names may contain arbitrary strings, so they must not be
interpreted as format strings.  It seems that only md allows arbitrary
strings to be used for disk names, but this could allow for a local
memory corruption from uid 0 into ring 0.

CVE-2013-2851

Signed-off-by: Kees Cook 
Cc: Jens Axboe 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 

[jmm: Backport to 2.6.32]
Signed-off-by: Willy Tarreau

cpqarray: fix info leak in ida_locked_ioctl()

2014-05-19T05:53:15+00:00

commit 627aad1c01da6f881e7f98d71fd928ca0c316b1a upstream

The pciinfo struct has a two byte hole after ->dev_fn so stack
information could be leaked to the user.

This was assigned CVE-2013-2147.

Signed-off-by: Dan Carpenter 
Acked-by: Mike Miller 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Willy Tarreau

cciss: fix info leak in cciss_ioctl32_passthru()

2014-05-19T05:53:14+00:00

commit 58f09e00ae095e46ef9edfcf3a5fd9ccdfad065e upstream.

The arg64 struct has a hole after ->buf_size which isn't cleared.  Or if
any of the calls to copy_from_user() fail then that would cause an
information leak as well.

This was assigned CVE-2013-2147.

Signed-off-by: Dan Carpenter 
Acked-by: Mike Miller 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Willy Tarreau

cciss: fix incorrect scsi status reporting

2012-10-07T21:38:24+00:00

commit b0cf0b118c90477d1a6811f2cd2307f6a5578362 upstream.

Delete code which sets SCSI status incorrectly as it's already been set
correctly above this incorrect code.  The bug was introduced in 2009 by
commit b0e15f6db111 ("cciss: fix typo that causes scsi status to be
lost.")

Signed-off-by: Stephen M. Cameron 
Reported-by: Roel van Meer 
Tested-by: Roel van Meer 
Cc: Jens Axboe 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Willy Tarreau

block, sx8: fix pointer math issue getting fw version

2012-10-07T21:37:33+00:00

commit ea5f4db8ece896c2ab9eafa0924148a2596c52e4 upstream.

"mem" is type u8.  We need parenthesis here or it screws up the pointer
math probably leading to an oops.

Signed-off-by: Dan Carpenter 
Acked-by: Jeff Garzik 
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Willy Tarreau

blkfront: Fix backtrace in del_gendisk

2012-03-17T10:14:52+00:00

Commit 89de1669ace055b56f1de1c9f5aca26dd7f17f25 upstream.

The call to del_gendisk follows an non-refcounted gd->queue
pointer. We release the last ref in blk_cleanup_queue. Fixed by
reordering releases accordingly.

Signed-off-by: Daniel Stodden 
Signed-off-by: Jeremy Fitzhardinge 
Signed-off-by: David Vrabel 
Signed-off-by: Willy Tarreau

block: add and use scsi_blk_cmd_ioctl

2012-01-25T21:53:24+00:00

commit 577ebb374c78314ac4617242f509e2f5e7156649 upstream.

Introduce a wrapper around scsi_cmd_ioctl that takes a block device.

The function will then be enhanced to detect partition block devices
and, in that case, subject the ioctls to whitelisting.

Cc: linux-scsi@vger.kernel.org
Cc: Jens Axboe 
Cc: James Bottomley 
Signed-off-by: Paolo Bonzini 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backport to 2.6.32 - adjust context]
Signed-off-by: Ben Hutchings