linux-stable.git/kernel, branch linux-2.6.14.y

[PATCH] sysctl: make sure to terminate strings with a NUL

2006-01-08T02:15:08+00:00

This is a slightly more complete fix for the previous minimal sysctl
string fix.  It always terminates the returned string with a NUL, even
if the full result wouldn't fit in the user-supplied buffer.

The returned length is the full untruncated length, so that you can
tell when truncation has occurred.

Signed-off-by: Linus Torvalds 
[chrisw: inclusive of minimal fix so it's same as upstream]
Signed-off-by: Chris Wright

[PATCH] kernel/params.c: fix sysfs access with CONFIG_MODULES=n

2005-12-27T00:08:58+00:00

All the work was done to setup the file and maintain the file handles but
the access functions were zeroed out due to the #ifdef.  Removing the
#ifdef allows full access to all the parameters when CONFIG_MODULES=n.

akpm: put it back again, but use CONFIG_SYSFS instead.

This patch has already been included in Linus' tree.

Signed-off-by: Jason Wessel 
Signed-off-by: Andrew Morton 
Signed-off-by: Adrian Bunk 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Add try_to_freeze to kauditd

2005-12-14T23:43:00+00:00

kauditd was causing suspends to fail because it refused to freeze.  Adding
a try_to_freeze() to its sleep loop solves the issue.

Signed-off-by: Pierre Ossman 
Acked-by: Pavel Machek 
Cc: David Woodhouse 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix crash when ptrace poking hugepage areas

2005-12-14T23:42:54+00:00

set_page_dirty() will not cope with being handed a page * which is part of
a compound page, but not the master page in that compound page.  This case
can occur via access_process_vm() if you attemp to write to another
process's hugepage memory area using ptrace() (causing an oops or hang).

This patch fixes the bug by only calling set_page_dirty() from
access_process_vm() if the page is not a compound page.  We already use a
similar fix in bio_set_pages_dirty() for the case of direct io to
hugepages.

Signed-off-by: David Gibson 
Acked-by: William Irwin 
Signed-off-by: Andrew Morton 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Don't auto-reap traced children

2005-11-24T22:10:07+00:00

If a task is being traced we never auto-reap it even if it might look
like its parent doesn't care. The tracer obviously _does_ care.

Signed-off-by: Linus Torvalds 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix ptrace self-attach rule

2005-11-11T05:22:08+00:00

Before we did CLONE_THREAD, the way to check whether we were attaching
to ourselves was to just check "current == task", but with CLONE_THREAD
we should check that the thread group ID matches instead.

Signed-off-by: Linus Torvalds

[PATCH] - fix signal->live leak in copy_process()

2005-11-11T05:18:55+00:00

exit_signal() (called from copy_process's error path) should decrement
->signal->live, otherwise forking process will miss 'group_dead' in
do_exit().

Signed-off-by: Oleg Nesterov 
Signed-off-by: Chris Wright 
Signed-off-by: Greg Kroah-Hartman

[PATCH] CVE-2005-2709 sysctl unregistration oops

2005-11-08T19:14:00+00:00

You could open the /proc/sys/net/ipv4/conf// file, then
wait for interface to go away, try to grab as much memory as possible in
hope to hit the (kfreed) ctl_table.  Then fill it with pointers to your
function. Then do read from file you've opened and if you are lucky,
you'll get it called as ->proc_handler() in kernel mode.

So this is at least an Oops and possibly more.  It does depend on an
interface going away though, so less of a security risk than it would
otherwise be.

Signed-off-by: Greg Kroah-Hartman

[PATCH] Yet more posix-cpu-timer fixes

2005-10-27T16:08:43+00:00

This just makes sure that a thread's expiry times can't get reset after
it clears them in do_exit.

This is what allowed us to re-introduce the stricter BUG_ON() check in
a362f463a6d316d14daed0f817e151835ce97ff7.

Signed-off-by: Linus Torvalds

Revert "remove false BUG_ON() from run_posix_cpu_timers()"

2005-10-27T16:07:33+00:00

This reverts commit 3de463c7d9d58f8cf3395268230cb20a4c15bffa.

Roland has another patch that allows us to leave the BUG_ON() in place
by just making sure that the condition it tests for really is always
true.

That goes in next.

Signed-off-by: Linus Torvalds