linux.git/net/irda, branch v2.6.39

irda: fix locking unbalance in irda_sendmsg

2011-04-12T22:29:54+00:00

5b40964eadea40509d353318d2c82e8b7bf5e8a5 ("irda: Remove BKL instances
from af_irda.c") introduced a path where we have a locking unbalance.
If we pass invalid flags, we unlock a socket we never locked,
resulting in this...

=====================================
[ BUG: bad unlock balance detected! ]
-------------------------------------
trinity/20101 is trying to release lock (sk_lock-AF_IRDA) at:
[] irda_sendmsg+0x207/0x21d [irda]
but there are no more locks to release!

other info that might help us debug this:
no locks held by trinity/20101.

stack backtrace:
Pid: 20101, comm: trinity Not tainted 2.6.39-rc3+ #3
Call Trace:
 [] ? irda_sendmsg+0x207/0x21d [irda]
 [] print_unlock_inbalance_bug+0xc7/0xd2
 [] ? irda_sendmsg+0x207/0x21d [irda]
 [] lock_release+0xcf/0x18e
 [] release_sock+0x2d/0x155
 [] irda_sendmsg+0x207/0x21d [irda]
 [] __sock_sendmsg+0x69/0x75
 [] sock_sendmsg+0xa1/0xb6
 [] ? might_fault+0x5c/0xac
 [] ? lock_release+0x181/0x18e
 [] ? might_fault+0xa5/0xac
 [] ? might_fault+0x5c/0xac
 [] ? fcheck_files+0xb9/0xf0
 [] ? copy_from_user+0x2f/0x31
 [] ? verify_iovec+0x52/0xa6
 [] sys_sendmsg+0x23a/0x2b8
 [] ? lock_release+0x181/0x18e
 [] ? up_read+0x28/0x2c
 [] ? do_page_fault+0x360/0x3b4
 [] ? trace_hardirqs_on_caller+0x10b/0x12f
 [] ? finish_task_switch+0xb2/0xe3
 [] ? finish_task_switch+0x46/0xe3
 [] ? trace_hardirqs_off_caller+0x33/0x90
 [] ? retint_swapgs+0x13/0x1b
 [] ? trace_hardirqs_on_caller+0x10b/0x12f
 [] ? audit_syscall_entry+0x11c/0x148
 [] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [] system_call_fastpath+0x16/0x1b

Signed-off-by: Dave Jones 
Signed-off-by: David S. Miller

Fix common misspellings

2011-03-31T14:26:23+00:00

Fixes generated by 'codespell' and manually reviewed.

Signed-off-by: Lucas De Marchi

irda: validate peer name and attribute lengths

2011-03-28T00:59:02+00:00

Length fields provided by a peer for names and attributes may be longer
than the destination array sizes.  Validate lengths to prevent stack
buffer overflows.

Signed-off-by: Dan Rosenberg 
Cc: stable@kernel.org
Signed-off-by: David S. Miller

irda: prevent heap corruption on invalid nickname

2011-03-28T00:59:02+00:00

Invalid nicknames containing only spaces will result in an underflow in
a memcpy size calculation, subsequently destroying the heap and
panicking.

v2 also catches the case where the provided nickname is longer than the
buffer size, which can result in controllable heap corruption.

Signed-off-by: Dan Rosenberg 
Cc: stable@kernel.org
Signed-off-by: David S. Miller

tty: now phase out the ioctl file pointer for good

2011-02-17T19:59:56+00:00

Only oddities here are a couple of drivers that bogusly called the ldisc
helpers instead of returning -ENOIOCTLCMD. Fix the bug and the rest goes
away.

Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

tiocmset: kill the file pointer argument

2011-02-17T19:52:43+00:00

Doing tiocmget was such fun we should do tiocmset as well for the same
reasons

Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

tiocmget: kill off the passing of the struct file

2011-02-17T19:47:33+00:00

We don't actually need this and it causes problems for internal use of
this functionality. Currently there is a single use of the FILE * pointer.
That is the serial core which uses it to check tty_hung_up_p. However if
that is true then IO_ERROR is also already set so the check may be removed.

Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2010-12-27T06:37:05+00:00

Conflicts:
	net/ipv4/fib_frontend.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

2010-12-26T20:06:56+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits)
  ipv4: dont create routes on down devices
  epic100: hamachi: yellowfin: Fix skb allocation size
  sundance: Fix oopses with corrupted skb_shared_info
  Revert "ipv4: Allow configuring subnets as local addresses"
  USB: mcs7830: return negative if auto negotiate fails
  irda: prevent integer underflow in IRLMP_ENUMDEVICES
  tcp: fix listening_get_next()
  atl1c: Do not use legacy PCI power management
  mac80211: fix mesh forwarding
  MAINTAINERS: email address change
  net: Fix range checks in tcf_valid_offset().
  net_sched: sch_sfq: fix allot handling
  hostap: remove netif_stop_queue from init
  mac80211/rt2x00: add ieee80211_tx_status_ni()
  typhoon: memory corruption in typhoon_get_drvinfo()
  net: Add USB PID for new MOSCHIP USB ethernet controller MCS7832 variant
  net_sched: always clone skbs
  ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed.
  netlink: fix gcc -Wconversion compilation warning
  asix: add USB ID for Logitec LAN-GTJ U2A
  ...

irda: prevent integer underflow in IRLMP_ENUMDEVICES

2010-12-23T18:09:43+00:00

If the user-provided len is less than the expected offset, the
IRLMP_ENUMDEVICES getsockopt will do a copy_to_user() with a very large
size value.  While this isn't be a security issue on x86 because it will
get caught by the access_ok() check, it may leak large amounts of kernel
heap on other architectures.  In any event, this patch fixes it.

Signed-off-by: Dan Rosenberg 
Signed-off-by: David S. Miller