linux/drivers, branch v2.6.16.59

CONNECTOR: don't touch queue dev after decrement of ref count

2008-01-15T23:18:12Z

cn_queue_free_callback() will touch 'dev'(i.e. cbq->pdev), so it should be called before atomic_dec(&dev->refcnt). Signed-off-by: Li Zefan Signed-off-by: Adrian Bunk

[NET] kaweth was forgotten in msec switchover of usb_start_wait_urb

2008-01-15T23:13:56Z

Back in 2.6.12-pre, usb_start_wait_urb was switched over to take milliseconds instead of jiffies. kaweth.c was never updated to match. Signed-off-by: Russ Dill Signed-off-by: Adrian Bunk

[SCSI] aacraid: fix security weakness

2008-01-06T02:19:00Z

Actually there are several but one is trivially fixed 1. FSACTL_GET_NEXT_ADAPTER_FIB ioctl does not lock dev->fib_list but needs to 2. Ditto for FSACTL_CLOSE_GET_ADAPTER_FIB 3. It is possible to construct an attack via the SRB ioctls where the user obtains assorted elevated privileges. Various approaches are possible, the trivial ones being things like writing to the raw media via scsi commands and the swap image of other executing programs with higher privileges. So the ioctls should be CAP_SYS_RAWIO - at least all the FIB manipulating ones. This is a bandaid fix for #3 but probably the ioctls should grow their own capable checks. The other two bugs need someone competent in that driver to fix them. Signed-off-by: Alan Cox Acked-by: Mark Salyzyn Signed-off-by: James Bottomley Signed-off-by: Adrian Bunk

hwmon/lm87: Fix a division by zero

2008-01-06T02:18:59Z

Missing parentheses in the definition of FAN_FROM_REG cause a division by zero for a specific register value. Signed-off-by: Jean Delvare Acked-by: Hans de Goede Signed-off-by: Mark M. Hoffman Signed-off-by: Greg Kroah-Hartman Signed-off-by: Adrian Bunk

hwmon/lm87: Disable VID when it should be

2008-01-06T02:18:59Z

A stupid bit shifting bug caused the VID value to be always exported even when the hardware is configured for something different. Signed-off-by: Jean Delvare Signed-off-by: Mark M. Hoffman Signed-off-by: Greg Kroah-Hartman Signed-off-by: Adrian Bunk

[ATM]: [he] initialize lock and tasklet earlier

2008-01-06T02:18:59Z

[ Upstream commit: 8a8037ac9dbe4eb20ce50aa20244faf77444f4a3 ] if you are lucky (unlucky?) enough to have shared interrupts, the interrupt handler can be called before the tasklet and lock are ready for use. Signed-off-by: Chas Williams Signed-off-by: Herbert Xu Signed-off-by: Adrian Bunk

PPPOE: fix memory leak (local DoS) (CVE-2007-2525)

2007-11-13T10:12:46Z

This patch fixes a memory leak when a PPPoE socket is release()d after it has been connect()ed, but before the PPPIOCGCHAN ioctl ever has been called on it. This is somewhat of a security problem, too, since PPPoE sockets can be created by any user, so any user can easily allocate all the machine's RAM to non-swappable address space and thus DoS the system. Is there any specific reason for PPPoE sockets being available to any unprivileged process, BTW? After all, you need a packet socket for the discovery stage anyway, so it's unlikely that any unprivileged process will ever need to create a PPPoE socket, no? Allocating all session IDs for a known AC is a kind of DoS, too, after all - with Juniper ERXes, this is really easy, actually, since they don't ever assign session ids above 8000 ... Signed-off-by: Florian Zumbiehl Signed-off-by: Adrian Bunk

[ATM]: Add CPPFLAGS to byteorder.h check

2007-11-13T06:50:09Z

O= builds produced errors in the shell command because of unfound headers. Signed-off-by: Ben Collins Signed-off-by: Adrian Bunk

[PPP_MPPE]: Don't put InterimKey on the stack

2007-11-13T06:48:46Z

ppp_mppe puts a crypto key on the kernel stack, then passes the address of that into the crypto layer. That doesn't work because the crypto layer needs to be able to do virt_to_*() on the address which does not universally work for the kernel stack on all platforms. Adrian Bunk: Backported to 2.6.16. Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller Signed-off-by: Adrian Bunk

[Bluetooth] Fix NULL pointer dereference in HCI line discipline

2007-11-02T03:41:26Z

Normally a serial Bluetooth device is opened, TIOSETD'ed to N_HCI line discipline, HCIUARTSETPROTO'ed and finally closed. In case the device fails to HCIUARTSETPROTO, closing it produces a NULL pointer dereference. Signed-off-by: Ohad Ben-Cohen Signed-off-by: Marcel Holtmann Signed-off-by: Adrian Bunk