linux, branch v2.6.16.58

Linux 2.6.16.58

2008-01-06T15:54:15Z

Linux 2.6.16.58-rc1

2008-01-06T02:19:00Z

[SCSI] aacraid: fix security weakness

2008-01-06T02:19:00Z

Actually there are several but one is trivially fixed 1. FSACTL_GET_NEXT_ADAPTER_FIB ioctl does not lock dev->fib_list but needs to 2. Ditto for FSACTL_CLOSE_GET_ADAPTER_FIB 3. It is possible to construct an attack via the SRB ioctls where the user obtains assorted elevated privileges. Various approaches are possible, the trivial ones being things like writing to the raw media via scsi commands and the swap image of other executing programs with higher privileges. So the ioctls should be CAP_SYS_RAWIO - at least all the FIB manipulating ones. This is a bandaid fix for #3 but probably the ioctls should grow their own capable checks. The other two bugs need someone competent in that driver to fix them. Signed-off-by: Alan Cox Acked-by: Mark Salyzyn Signed-off-by: James Bottomley Signed-off-by: Adrian Bunk

hwmon/lm87: Fix a division by zero

2008-01-06T02:18:59Z

Missing parentheses in the definition of FAN_FROM_REG cause a division by zero for a specific register value. Signed-off-by: Jean Delvare Acked-by: Hans de Goede Signed-off-by: Mark M. Hoffman Signed-off-by: Greg Kroah-Hartman Signed-off-by: Adrian Bunk

hwmon/lm87: Disable VID when it should be

2008-01-06T02:18:59Z

A stupid bit shifting bug caused the VID value to be always exported even when the hardware is configured for something different. Signed-off-by: Jean Delvare Signed-off-by: Mark M. Hoffman Signed-off-by: Greg Kroah-Hartman Signed-off-by: Adrian Bunk

[PFKEY]: Sending an SADB_GET responds with an SADB_GET

2008-01-06T02:18:59Z

[ Upstream commit: 435000bebd94aae3a7a50078d142d11683d3b193 ] Kernel needs to respond to an SADB_GET with the same message type to conform to the RFC 2367 Section 3.1.5 Signed-off-by: Andrew Morton Signed-off-by: Herbert Xu Signed-off-by: Adrian Bunk

[ATM]: [he] initialize lock and tasklet earlier

2008-01-06T02:18:59Z

[ Upstream commit: 8a8037ac9dbe4eb20ce50aa20244faf77444f4a3 ] if you are lucky (unlucky?) enough to have shared interrupts, the interrupt handler can be called before the tasklet and lock are ready for use. Signed-off-by: Chas Williams Signed-off-by: Herbert Xu Signed-off-by: Adrian Bunk

tmpfs: restore missing clear_highpage (CVE-2007-6417)

2008-01-06T02:18:21Z

tmpfs was misconverted to __GFP_ZERO in 2.6.11. There's an unusual case in which shmem_getpage receives the page from its caller instead of allocating. We must cover this case by clear_highpage before SetPageUptodate, as before. Signed-off-by: Hugh Dickins Signed-off-by: Adrian Bunk

ipv4/arp.c:arp_process(): remove bogus #ifdef mess

2007-12-09T19:33:23Z

The #ifdef's in arp_process() were not only a mess, they were also wrong in the CONFIG_NET_ETHERNET=n and (CONFIG_NETDEV_1000=y or CONFIG_NETDEV_10000=y) cases. Since they are not required this patch removes them. Also removed are some #ifdef's around #include's that caused compile errors after this change. Signed-off-by: Adrian Bunk

[NETLINK]: Fix unicast timeouts

2007-11-13T11:23:22Z

[ Upstream commit: c3d8d1e30cace31fed6186a4b8c6b1401836d89c ] Commit ed6dcf4a in the history.git tree broke netlink_unicast timeouts by moving the schedule_timeout() call to a new function that doesn't propagate the remaining timeout back to the caller. This means on each retry we start with the full timeout again. ipc/mqueue.c seems to actually want to wait indefinitely so this behaviour is retained. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk