1. 14 10月, 2013 1 次提交
    • J
      wireless: radiotap: fix parsing buffer overrun · f5563318
      Johannes Berg 提交于
      When parsing an invalid radiotap header, the parser can overrun
      the buffer that is passed in because it doesn't correctly check
       1) the minimum radiotap header size
       2) the space for extended bitmaps
      
      The first issue doesn't affect any in-kernel user as they all
      check the minimum size before calling the radiotap function.
      The second issue could potentially affect the kernel if an skb
      is passed in that consists only of the radiotap header with a
      lot of extended bitmaps that extend past the SKB. In that case
      a read-only buffer overrun by at most 4 bytes is possible.
      
      Fix this by adding the appropriate checks to the parser.
      
      Cc: stable@vger.kernel.org
      Reported-by: NEvan Huus <eapache@gmail.com>
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      f5563318
  2. 10 10月, 2013 2 次提交
  3. 30 9月, 2013 3 次提交
  4. 27 9月, 2013 4 次提交
  5. 26 9月, 2013 1 次提交
  6. 17 9月, 2013 5 次提交
  7. 16 9月, 2013 3 次提交
    • L
      Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus · d8efd82e
      Linus Torvalds 提交于
      Pull MIPS fixes from Ralf Baechle:
       "These are four patches for three construction sites:
      
         - Fix register decoding for the combination of multi-core processors
           and multi-threading.
      
         - Two more fixes that are part of the ongoing DECstation resurrection
           work.  One of these touches a DECstation-only network driver.
      
         - Finally Markos' trivial build fix for the AP/SP support.
      
        (With this applied now all MIPS defconfigs are building again)"
      
      * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
        MIPS: kernel: vpe: Make vpe_attrs an array of pointers.
        MIPS: Fix SMP core calculations when using MT support.
        MIPS: DECstation I/O ASIC DMA interrupt handling fix
        MIPS: DECstation HRT initialization rearrangement
      d8efd82e
    • L
      Merge branch 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86 · cd619e21
      Linus Torvalds 提交于
      Pull x86 platform updates from Matthew Garrett:
       "Nothing amazing here, almost entirely cleanups and minor bugfixes and
        one bit of hardware enablement in the amilo-rfkill driver"
      
      * 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86:
        platform/x86: panasonic-laptop: reuse module_acpi_driver
        samsung-laptop: fix config build error
        platform: x86: remove unnecessary platform_set_drvdata()
        amilo-rfkill: Enable using amilo-rfkill with the FSC Amilo L1310.
        wmi: parse_wdg() should return kernel error codes
        hp_wmi: Fix unregister order in hp_wmi_rfkill_setup()
        platform: replace strict_strto*() with kstrto*()
        x86: irst: use module_acpi_driver to simplify the code
        x86: smartconnect: use module_acpi_driver to simplify the code
        platform samsung-q10: use ACPI instead of direct EC calls
        thinkpad_acpi: add the ability setting TPACPI_LED_NONE by quirk
        thinkpad_acpi: return -NODEV while operating uninitialized LEDs
      cd619e21
    • L
      Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 0375ec58
      Linus Torvalds 提交于
      Pull misc SCSI driver updates from James Bottomley:
       "This patch set is a set of driver updates (megaraid_sas, fnic, lpfc,
        ufs, hpsa) we also have a couple of bug fixes (sd out of bounds and
        ibmvfc error handling) and the first round of esas2r checker fixes and
        finally the much anticipated big endian additions for megaraid_sas"
      
      * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (47 commits)
        [SCSI] fnic: fnic Driver Tuneables Exposed through CLI
        [SCSI] fnic: Kernel panic while running sh/nosh with max lun cfg
        [SCSI] fnic: Hitting BUG_ON(io_req->abts_done) in fnic_rport_exch_reset
        [SCSI] fnic: Remove QUEUE_FULL handling code
        [SCSI] fnic: On system with >1.1TB RAM, VIC fails multipath after boot up
        [SCSI] fnic: FC stat param seconds_since_last_reset not getting updated
        [SCSI] sd: Fix potential out-of-bounds access
        [SCSI] lpfc 8.3.42: Update lpfc version to driver version 8.3.42
        [SCSI] lpfc 8.3.42: Fixed issue of task management commands having a fixed timeout
        [SCSI] lpfc 8.3.42: Fixed inconsistent spin lock usage.
        [SCSI] lpfc 8.3.42: Fix driver's abort loop functionality to skip IOs already getting aborted
        [SCSI] lpfc 8.3.42: Fixed failure to allocate SCSI buffer on PPC64 platform for SLI4 devices
        [SCSI] lpfc 8.3.42: Fix WARN_ON when driver unloads
        [SCSI] lpfc 8.3.42: Avoided making pci bar ioremap call during dual-chute WQ/RQ pci bar selection
        [SCSI] lpfc 8.3.42: Fixed driver iocbq structure's iocb_flag field running out of space
        [SCSI] lpfc 8.3.42: Fix crash on driver load due to cpu affinity logic
        [SCSI] lpfc 8.3.42: Fixed logging format of setting driver sysfs attributes hard to interpret
        [SCSI] lpfc 8.3.42: Fixed back to back RSCNs discovery failure.
        [SCSI] lpfc 8.3.42: Fixed race condition between BSG I/O dispatch and timeout handling
        [SCSI] lpfc 8.3.42: Fixed function mode field defined too small for not recognizing dual-chute mode
        ...
      0375ec58
  8. 15 9月, 2013 4 次提交
  9. 14 9月, 2013 8 次提交
  10. 13 9月, 2013 9 次提交