Skip to content

K
Kernel

openeuler / Kernel
大约 1 年 前同步成功

通知 7
Star 0
Fork 0
K
Kernel
切换分支/标签
  1. 11 4月, 2008 33 次提交
  3. 10 4月, 2008 7 次提交
    • D
      [IPV4]: Fix byte value boundary check in do_ip_getsockopt(). · 951e07c9
      由 David S. Miller 提交于 
      This fixes kernel bugzilla 10371.

As reported by M.Piechaczek@osmosys.tv, if we try to grab a
char sized socket option value, as in:

  unsigned char ttl = 255;
  socklen_t     len = sizeof(ttl);
  setsockopt(socket, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, &len);

  getsockopt(socket, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, &len);

The ttl returned will be wrong on big-endian, and on both little-
endian and big-endian the next three bytes in userspace are written
with garbage.

It's because of this test in do_ip_getsockopt():

	if (len < sizeof(int) && len > 0 && val>=0 && val<255) {

It should allow a 'val' of 255 to pass here, but it doesn't so it
copies a full 'int' back to userspace.

On little-endian that will write the correct value into the location
but it spams on the next three bytes in userspace.  On big endian it
writes the wrong value into the location and spams the next three
bytes.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      951e07c9
    • F
      cfq-iosched: do not leak ioc_data across iosched switches · 4faa3c81
      由 Fabio Checconi 提交于 
      When switching scheduler from cfq, cfq_exit_queue() does not clear
ioc->ioc_data, leaving a dangling pointer that can deceive the following
lookups when the iosched is switched back to cfq.  The pattern that can
trigger that is the following:

    - elevator switch from cfq to something else;
    - module unloading, with elv_unregister() that calls cfq_free_io_context()
      on ioc freeing the cic (via the .trim op);
    - module gets reloaded and the elevator switches back to cfq;
    - reallocation of a cic at the same address as before (with a valid key).

To fix it just assign NULL to ioc_data in __cfq_exit_single_io_context(),
that is called from the regular exit path and from the elevator switching
code.  The only path that frees a cic and is not covered is the error handling
one, but cic's freed in this way are never cached in ioc_data.
Signed-off-by: NFabio Checconi <fabio@gandalf.sssup.it>
Signed-off-by: NJens Axboe <jens.axboe@oracle.com>
      4faa3c81
    • E
      [XFS] Ensure "both" features2 slots are consistent · e6957ea4
      由 Eric Sandeen 提交于 
      Since older kernels may look in the sb_bad_features2 slot for flags,
rather than zeroing it out on fixup, we should make it equal to the
sb_features2 value.

Also, if the ATTR2 flag was not found prior to features2 fixup, it was not
set in the mount flags, so re-check after the fixup so that the current
session will use the feature.

Also fix up the comments to reflect these changes.

SGI-PV: 980085
SGI-Modid: xfs-linux-melb:xfs-kern:30778a
Signed-off-by: NEric Sandeen <sandeen@sandeen.net>
Signed-off-by: NDavid Chinner <dgc@sgi.com>
Signed-off-by: NLachlan McIlroy <lachlan@sgi.com>
      e6957ea4
    • D
      [XFS] Fix superblock features2 field alignment problem · ee1c0908
      由 David Chinner 提交于 
      Due to the xfs_dsb_t structure not being 64 bit aligned, the last field of
the on-disk superblock can vary in location This causes problems when the
filesystem gets moved to a different platform, or there is a 32 bit
userspace and 64 bit kernel.

This patch detects the defect at mount time, logs a warning such as:

XFS: correcting sb_features alignment problem

in dmesg and corrects the problem so that everything is OK. it also
blacklists the bad field in the superblock so it does not get used for
something else later on.

SGI-PV: 977636
SGI-Modid: xfs-linux-melb:xfs-kern:30539a
Signed-off-by: NDavid Chinner <dgc@sgi.com>
Signed-off-by: NChristoph Hellwig <hch@infradead.org>
Signed-off-by: NEric Sandeen <sandeen@sandeen.net>
Signed-off-by: NLachlan McIlroy <lachlan@sgi.com>
      ee1c0908
    • E
      [XFS] remove shouting-indirection macros from xfs_sb.h · 62118709
      由 Eric Sandeen 提交于 
      Remove macro-to-small-function indirection from xfs_sb.h, and remove some
which are completely unused.

SGI-PV: 976035
SGI-Modid: xfs-linux-melb:xfs-kern:30528a
Signed-off-by: NEric Sandeen <sandeen@sandeen.net>
Signed-off-by: NDonald Douwsma <donaldd@sgi.com>
Signed-off-by: NLachlan McIlroy <lachlan@sgi.com>
      62118709
    • J
      splice: fix infinite loop in generic_file_splice_read() · 8191ecd1
      由 Jens Axboe 提交于 
      There's a quirky loop in generic_file_splice_read() that could go
on indefinitely, if the file splice returns 0 permanently (and not
just as a temporary condition). Get rid of the loop and pass
back -EAGAIN correctly from __generic_file_splice_read(), so we
handle that condition properly as well.
Signed-off-by: NJens Axboe <jens.axboe@oracle.com>
      8191ecd1
    • D
      [SPARC]: Fix several regset and ptrace bugs. · d786a4a6
      由 David S. Miller 提交于 
      1) ptrace should pass 'current' to task_user_regset_view()

2) When fetching general registers using a 64-bit view, and
   the target is 32-bit, we have to convert.

3) Skip the whole register window get/set code block if
   the user isn't asking to access anything in there.

   Otherwise we have problems if the user doesn't have
   an address space setup.  Fetching ptrace register is
   still valid at such a time, and ptrace does not try
   to access the register window area of the regset.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      d786a4a6