1. 13 10月, 2007 1 次提交
  2. 12 2月, 2007 1 次提交
    • J
      [PATCH] raw: don't allow the creation of a raw device with minor number 0 · 38584c14
      Jeff Moyer 提交于
      Minor number 0 (under the raw major) is reserved for the rawctl device
      file, which is used to query, set, and unset raw device bindings.  However,
      the ioctl interface does not protect the user from specifying a raw device
      with minor number 0:
      
      $ sudo ./raw /dev/raw/raw0 /dev/VolGroup00/swap
      /dev/raw/raw0:  bound to major 253, minor 2
      $ ls -l /dev/rawctl
      ls: /dev/rawctl: No such file or directory
      $ ls -l /dev/raw/raw0
      crw------- 1 root root 162, 0 Jan 12 10:51 /dev/raw/raw0
      $ sudo ./raw -qa
      Cannot open master raw device '/dev/rawctl' (No such file or directory)
      
      As you can see, this prevents any further raw operations from
      succeeding.  The fix (from Steve Fernandez) is quite simple--do not
      allow the allocation of minor number 0.
      Signed-off-by: NJeff Moyer <jmoyer@redhat.com>
      Cc: Steven Fernandez <sfernand@redhat.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      38584c14
  3. 09 12月, 2006 1 次提交
  4. 02 12月, 2006 1 次提交
  5. 01 10月, 2006 3 次提交
  6. 30 9月, 2006 1 次提交
  7. 04 7月, 2006 1 次提交
  8. 27 6月, 2006 3 次提交
  9. 23 3月, 2006 1 次提交
  10. 29 10月, 2005 1 次提交
  11. 21 6月, 2005 1 次提交
  12. 19 5月, 2005 1 次提交
    • S
      [PATCH] Fix filp being passed through raw ioctl handler · e72022e1
      Stephen Tweedie 提交于
      Don't pass meaningless file handles to block device ioctls.
      
      The recent raw IO ioctl-passthrough fix started passing the raw file
      handle into the block device ioctl handler.  That's unlikely to be
      useful, as the file handle is actually open on a character-mode raw
      device, not a block device, so dereferencing it is not going to yield
      useful results to a block device ioctl handler.
      
      Previously we just passed NULL; also not a value that can usefully
      be dereferenced, but at least if it does happen, we'll oops instead of
      silently pretending that the file is a block device, so NULL is the more
      defensive option here.  This patch reverts to that behaviour.
      
      Noticed by Al Viro.
      Signed-off-by: NStephen Tweedie <sct@redhat.com>
      Acked-by: NAl Viro <viro@parcelfarce.linux.theplanet.co.uk>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      e72022e1
  13. 17 5月, 2005 1 次提交
    • S
      [PATCH] Fix root hole in raw device · 68f66feb
      Stephen Tweedie 提交于
      [Patch] Fix raw device ioctl pass-through
      
      Raw character devices are supposed to pass ioctls through to the block
      devices they are bound to.  Unfortunately, they are using the wrong
      function for this: ioctl_by_bdev(), instead of blkdev_ioctl().
      
      ioctl_by_bdev() performs a set_fs(KERNEL_DS) before calling the ioctl,
      redirecting the user-space buffer access to the kernel address space.
      This is, needless to say, a bad thing.
      
      This was noticed first on s390, where raw IO was non-functioning.  The
      s390 driver config does not actually allow raw IO to be enabled, which
      was the first part of the problem.  Secondly, the s390 kernel address
      space is distinct from user, causing legal raw ioctls to fail.  I've
      reproduced this on a kernel built with 4G:4G split on x86, which fails
      in the same way (-EFAULT if the address does not exist kernel-side;
      returns success without actually populating the user buffer if it does.)
      
      The patch below fixes both the config and address-space problems.  It's
      based closely on a patch by Jan Glauber <jang@de.ibm.com>, which has
      been tested on s390 at IBM.  I've tested it on x86 4G:4G (split address
      space) and x86_64 (common address space).
      
      Kernel-address-space access has been assigned CAN-2005-1264.
      Signed-off-by: NStephen Tweedie <sct@redhat.com>
      Signed-off-by: NDave Jones <davej@redhat.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      68f66feb
  14. 17 4月, 2005 1 次提交
    • L
      Linux-2.6.12-rc2 · 1da177e4
      Linus Torvalds 提交于
      Initial git repository build. I'm not bothering with the full history,
      even though we have it. We can create a separate "historical" git
      archive of that later if we want to, and in the meantime it's about
      3.2GB when imported into git - space that would just make the early
      git days unnecessarily complicated, when we don't have a lot of good
      infrastructure for it.
      
      Let it rip!
      1da177e4