linux-stable.git/drivers/staging/bcm, branch linux-3.10.y

Staging: bcm: info leak in ioctl

2013-11-13T03:05:33+00:00

commit 8d1e72250c847fa96498ec029891de4dc638a5ba upstream.

The DevInfo.u32Reserved[] array isn't initialized so it leaks kernel
information to user space.

Reported-by: Nico Golde 
Reported-by: Fabian Yamaguchi 
Signed-off-by: Dan Carpenter 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: Fix spelling error in PHSModule.c

2013-03-11T16:16:35+00:00

This patch fixes a spelling error in PHSModule.c

Signed-off-by: Kevin McKinney 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: Properly format comments in PHSModule.c

2013-03-11T16:16:35+00:00

This patch properly formats comments, and removes
them as needed in PHSModule.c.

Signed-off-by: Kevin McKinney 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: Properly format braces in PHSModule.c

2013-03-11T16:16:35+00:00

This patch formats braces in PHSModule.c as reported
by checkpatch.pl.

Signed-off-by: Kevin McKinney 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: Fix all white space issues in PHSModule.c

2013-03-11T16:16:35+00:00

This patch fixes all white space issues in
PHSModule.c as reported by checkpatch.pl.

Signed-off-by: Kevin McKinney 
Signed-off-by: Greg Kroah-Hartman

staging: bcm: don't cast kzalloc() return value

2013-03-11T16:15:32+00:00

Signed-off-by: Mihnea Dobrescu-Balaur 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: potential forever loop verifying firmware

2013-03-11T16:15:32+00:00

There is an ioctl() to write data to the firmware.  After the data
is written, it reads the databack from the firmware and compares
against what the user wanted to write and prints an error message
if it doesn't match.

The problem is that verify process has a forever loop if the
firmware size is not a multiple of 4.  I've fixed it by replacing
the bcm compare function with memcmp().

I have chopped out some debugging code in the process.

Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

Staging: bcm: avoid use-after-free in bcm_char_ioctl()

2013-03-11T16:15:32+00:00

Free pBulkBuffer (pvBuffer) after pBulkBuffer->Register.

Signed-off-by: Xi Wang 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2013-02-27T04:16:07+00:00

Pull vfs pile (part one) from Al Viro:
 "Assorted stuff - cleaning namei.c up a bit, fixing ->d_name/->d_parent
  locking violations, etc.

  The most visible changes here are death of FS_REVAL_DOT (replaced with
  "has ->d_weak_revalidate()") and a new helper getting from struct file
  to inode.  Some bits of preparation to xattr method interface changes.

  Misc patches by various people sent this cycle *and* ocfs2 fixes from
  several cycles ago that should've been upstream right then.

  PS: the next vfs pile will be xattr stuff."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (46 commits)
  saner proc_get_inode() calling conventions
  proc: avoid extra pde_put() in proc_fill_super()
  fs: change return values from -EACCES to -EPERM
  fs/exec.c: make bprm_mm_init() static
  ocfs2/dlm: use GFP_ATOMIC inside a spin_lock
  ocfs2: fix possible use-after-free with AIO
  ocfs2: Fix oops in ocfs2_fast_symlink_readpage() code path
  get_empty_filp()/alloc_file() leave both ->f_pos and ->f_version zero
  target: writev() on single-element vector is pointless
  export kernel_write(), convert open-coded instances
  fs: encode_fh: return FILEID_INVALID if invalid fid_type
  kill f_vfsmnt
  vfs: kill FS_REVAL_DOT by adding a d_weak_revalidate dentry op
  nfsd: handle vfs_getattr errors in acl protocol
  switch vfs_getattr() to struct path
  default SET_PERSONALITY() in linux/elf.h
  ceph: prepopulate inodes only when request is aborted
  d_hash_and_lookup(): export, switch open-coded instances
  9p: switch v9fs_set_create_acl() to inode+fid, do it before d_instantiate()
  9p: split dropping the acls from v9fs_set_create_acl()
  ...

new helper: file_inode(file)

2013-02-23T04:31:31+00:00

Signed-off-by: Al Viro