1. 08 8月, 2016 1 次提交
  2. 14 3月, 2016 1 次提交
    • A
      ipv4: Update parameters for csum_tcpudp_magic to their original types · 01cfbad7
      Alexander Duyck 提交于
      This patch updates all instances of csum_tcpudp_magic and
      csum_tcpudp_nofold to reflect the types that are usually used as the source
      inputs.  For example the protocol field is populated based on nexthdr which
      is actually an unsigned 8 bit value.  The length is usually populated based
      on skb->len which is an unsigned integer.
      
      This addresses an issue in which the IPv6 function csum_ipv6_magic was
      generating a checksum using the full 32b of skb->len while
      csum_tcpudp_magic was only using the lower 16 bits.  As a result we could
      run into issues when attempting to adjust the checksum as there was no
      protocol agnostic way to update it.
      
      With this change the value is still truncated as many architectures use
      "(len + proto) << 8", however this truncation only occurs for values
      greater than 16776960 in length and as such is unlikely to occur as we stop
      the inner headers at ~64K in size.
      
      I did have to make a few minor changes in the arm, mn10300, nios2, and
      score versions of the function in order to support these changes as they
      were either using things such as an OR to combine the protocol and length,
      or were using ntohs to convert the length which would have truncated the
      value.
      
      I also updated a few spots in terms of whitespace and type differences for
      the addresses.  Most of this was just to make sure all of the definitions
      were in sync going forward.
      Signed-off-by: NAlexander Duyck <aduyck@mirantis.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      01cfbad7
  3. 18 9月, 2015 1 次提交
  4. 01 2月, 2014 1 次提交
    • M
      alpha: fix broken network checksum · 0ef38d70
      Mikulas Patocka 提交于
      The patch 3ddc5b46 breaks networking on
      alpha (there is a follow-up fix 5cfe8f1b,
      but networking is still broken even with the second patch).
      
      The patch 3ddc5b46 makes
      csum_partial_copy_from_user check the pointer with access_ok. However,
      csum_partial_copy_from_user is called also from csum_partial_copy_nocheck
      and csum_partial_copy_nocheck is called on kernel pointers and it is
      supposed not to check pointer validity.
      
      This bug results in ssh session hangs if the system is loaded and bulk
      data are printed to ssh terminal.
      
      This patch fixes csum_partial_copy_nocheck to call set_fs(KERNEL_DS), so
      that access_ok in csum_partial_copy_from_user accepts kernel-space
      addresses.
      
      Cc: stable@vger.kernel.org
      Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
      Signed-off-by: NMatt Turner <mattst88@gmail.com>
      0ef38d70
  5. 17 11月, 2013 2 次提交
    • J
      alpha: Prevent a NULL ptr dereference in csum_partial_copy. · 5cfe8f1b
      Jay Estabrook 提交于
      Introduced by 3ddc5b46 ("kernel-wide: fix missing validations
      on __get/__put/__copy_to/__copy_from_user()").
      
      Also fix some other places which could be problematic in a similar way,
      although they hadn't been proved so, as far as I can tell.
      
      Cc: Michael Cree <mcree@orcon.net.nz>
      Signed-off-by: NMatt Turner <mattst88@gmail.com>
      5cfe8f1b
    • R
      alpha: Eliminate compiler warning from memset macro · a47e5bb5
      Richard Henderson 提交于
      Compiling with GCC 4.8 yields several instances of
      
      crypto/vmac.c: In function ‘vmac_final’:
      crypto/vmac.c:616:9: warning: value computed is not used [-Wunused-value]
        memset(&mac, 0, sizeof(vmac_t));
               ^
      arch/alpha/include/asm/string.h:31:25: note: in definition of macro ‘memset’
           ? __builtin_memset((s),0,(n))          \
                               ^
      Converting the macro to an inline function eliminates this problem.
      
      However, doing only that causes problems with the GCC 3.x series.  The
      inline function cannot be named "memset", as otherwise we wind up with
      recursion via __builtin_memset.  Solve this by adjusting the symbols
      such that __memset is the inline, and ___memset is the real function.
      Signed-off-by: NRichard Henderson <rth@twiddle.net>
      a47e5bb5
  6. 12 9月, 2013 1 次提交
    • M
      kernel-wide: fix missing validations on __get/__put/__copy_to/__copy_from_user() · 3ddc5b46
      Mathieu Desnoyers 提交于
      I found the following pattern that leads in to interesting findings:
      
        grep -r "ret.*|=.*__put_user" *
        grep -r "ret.*|=.*__get_user" *
        grep -r "ret.*|=.*__copy" *
      
      The __put_user() calls in compat_ioctl.c, ptrace compat, signal compat,
      since those appear in compat code, we could probably expect the kernel
      addresses not to be reachable in the lower 32-bit range, so I think they
      might not be exploitable.
      
      For the "__get_user" cases, I don't think those are exploitable: the worse
      that can happen is that the kernel will copy kernel memory into in-kernel
      buffers, and will fail immediately afterward.
      
      The alpha csum_partial_copy_from_user() seems to be missing the
      access_ok() check entirely.  The fix is inspired from x86.  This could
      lead to information leak on alpha.  I also noticed that many architectures
      map csum_partial_copy_from_user() to csum_partial_copy_generic(), but I
      wonder if the latter is performing the access checks on every
      architectures.
      Signed-off-by: NMathieu Desnoyers <mathieu.desnoyers@efficios.com>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
      Cc: Matt Turner <mattst88@gmail.com>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Oleg Nesterov <oleg@redhat.com>
      Cc: David Miller <davem@davemloft.net>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      3ddc5b46
  7. 19 8月, 2012 1 次提交
    • M
      alpha: Use new generic strncpy_from_user() and strnlen_user() · f2db633d
      Michael Cree 提交于
      Similar to x86/sparc/powerpc implementations except:
      1) we implement an extremely efficient has_zero()/find_zero()
         sequence with both prep_zero_mask() and create_zero_mask()
         no-operations.
      2) Our output from prep_zero_mask() differs in that only the
         lowest eight bits are used to represent the zero bytes
         nevertheless it can be safely ORed with other similar masks
         from prep_zero_mask() and forms input to create_zero_mask(),
         the two fundamental properties prep_zero_mask() must satisfy.
      
      Tests on EV67 and EV68 CPUs revealed that the generic code is
      essentially as fast (to within 0.5% of CPU cycles) of the old
      Alpha specific code for large quadword-aligned strings, despite
      the 30% extra CPU instructions executed.  In contrast, the
      generic code for unaligned strings is substantially slower (by
      more than a factor of 3) than the old Alpha specific code.
      Signed-off-by: NMichael Cree <mcree@orcon.net.nz>
      Acked-by: NMatt Turner <mattst88@gmail.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      f2db633d
  8. 29 3月, 2012 1 次提交
  9. 27 7月, 2011 1 次提交
  10. 31 3月, 2011 1 次提交
  11. 17 1月, 2011 1 次提交
  12. 29 1月, 2008 1 次提交
  13. 18 12月, 2007 1 次提交
    • I
      alpha: strncpy/strncat fixes · fe4304ba
      Ivan Kokshaysky 提交于
      First of all, thanks to Bob Tracy <rct@frus.com> and
      Michael Cree <mcree@orcon.net.nz> for testing.
      Especially to Bob, as he has done titanic multi-day git-bisect
      work that finally helped to reproduce and nail down the bug
      (http://bugzilla.kernel.org/show_bug.cgi?id=9457).
      
      [ev6-]stxncpy.S: it's t12, not t2 register that is supposed to contain
      the last byte offset upon return. As a result of wrong register use
      (which was my fault back in 2003, IIRC), under some circumstances extra
      terminating zero bytes were added to destination string. This particularly
      led to incorrect DEVPATH strings generated in uevent and therefore to udev
      problems.
      
      strncpy.S: unrelated bug I found while testing the above fix - destination
      is not properly zero-padded then a byte count exceeds source length.
      Actually this is addition to strncpy fix from last year.
      Signed-off-by: NIvan Kokshaysky <ink@jurassic.park.msu.ru>
      Cc: Richard Henderson <rth@twiddle.net>
      Cc: Bob Tracy <rct@frus.com>
      Cc: Michael Cree <mcree@orcon.net.nz>
      Cc: Kay Sievers <kay.sievers@vrfy.org>
      Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      fe4304ba
  14. 20 10月, 2007 2 次提交
  15. 15 10月, 2007 1 次提交
    • S
      kbuild: enable 'make CFLAGS=...' to add additional options to CC · a0f97e06
      Sam Ravnborg 提交于
      The variable CFLAGS is a wellknown variable and the usage by
      kbuild may result in unexpected behaviour.
      On top of that several people over time has asked for a way to
      pass in additional flags to gcc.
      
      This patch replace use of CFLAGS with KBUILD_CFLAGS all over the
      tree and enabling one to use:
      make CFLAGS=...
      to specify additional gcc commandline options.
      
      One usecase is when trying to find gcc bugs but other
      use cases has been requested too.
      
      Patch was tested on following architectures:
      alpha, arm, i386, x86_64, mips, sparc, sparc64, ia64, m68k
      
      Test was simple to do a defconfig build, apply the patch and check
      that nothing got rebuild.
      Signed-off-by: NSam Ravnborg <sam@ravnborg.org>
      a0f97e06
  16. 18 7月, 2007 1 次提交
  17. 24 6月, 2007 1 次提交
  18. 31 5月, 2007 1 次提交
  19. 26 4月, 2007 1 次提交
  20. 03 12月, 2006 1 次提交
  21. 04 10月, 2006 1 次提交
  22. 01 7月, 2006 1 次提交
  23. 25 4月, 2006 1 次提交
  24. 27 3月, 2006 1 次提交
  25. 10 9月, 2005 1 次提交
  26. 17 4月, 2005 1 次提交
    • L
      Linux-2.6.12-rc2 · 1da177e4
      Linus Torvalds 提交于
      Initial git repository build. I'm not bothering with the full history,
      even though we have it. We can create a separate "historical" git
      archive of that later if we want to, and in the meantime it's about
      3.2GB when imported into git - space that would just make the early
      git days unnecessarily complicated, when we don't have a lot of good
      infrastructure for it.
      
      Let it rip!
      1da177e4