Vitaly V. Bursov <vitalyvb@ukr.net> wrote:
>
> there are multiple vulns in drivers/net/eql.c
>
> if there is no such device, dev_get_by_name returns NULL and everything dies.
> Exploiting this is trivial.

Thanks for the report.  This patch should fix them.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Cheers,
--
Visit Openswan at http://www.openswan.org/
Email:  Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
===== drivers/net/eql.c 1.13 vs edited =====

This contains hpfs fixes from my source ported to 2.6.7 kernel:

updates:
- allocator fragments files less
- OS/2 Warp Server filesystem can be mounted read/only
- added reschedule points so that it doesn't hog CPU

bug fixes:
- filesystem error message when syncing or fsyncing deleted file (or when
  system just writes it on its own)
- filesystem error on extremly fragmented files
- corrupted disk structures could possibly corrupt memory

drivers/message/fusion/mptctl.c:89:24: asm/compat.h: No such file or directory
Signed-off-by: Andrew Morton <akpm@osdl.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

In base kernel 2.6.7, there is bug in function hugetlb_prefault().  The
call to free_huge_page() is incorrect and should be replaced with a call
to page_cache_release().
Signed-off-by: David Mosberger <davidm@hpl.hp.com>

This patch moves the pfm_ovfl_arg_t structure from the kernel stack
into the pfm_context_t structure. This minimizes kernel stack space
consumption.
Signed-off-by: Stephane Eranian <eranian@hpl.hp.com>
Signed-off-by: David Mosberger <davidm@hpl.hp.com>

This patch moves move_irq() from ioaspic.c to irq.c to make this common
for ia64 subarches.
Signed-off-by: Ashok Raj <ashok.raj@intel.com>
Signed-off-by: David Mosberger <davidm@hpl.hp.com>

- Handle the overlapping mmaps in the MAP_FIXED case
- Handle unmaps correctly i.e. call __ia32_delete_pp_range()
- There are now three clear entry points into the pp manipulation code
        - ia32_set_pp
        - ia32_unset_pp
        - ia32_compare_pp
- Rename internal functions to __ia32_*pp_*
- Grab mmap_sem just once at the main entry point
Signed-off-by: Gordon Jin <gordon.jin@intel.com>
Signed-off-by: Arun Sharma <arun.sharma@intel.com>
Signed-off-by: David Mosberger <davidm@hpl.hp.com>

A classic..

  lib/string.c:165:19: warning: assignment expression in conditional

From: Mika Kukkonen <mika@osdl.org>
Signed-off-by: Randy Dunlap <rddunlap@osdl.org>

Add __user annotation for !CONFIG_MODULE_UNLOAD case.

From: Mika Kukkonen <mika@osdl.org>
Signed-off-by: Randy Dunlap <rddunlap@osdl.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

 - added define of __x86_64__ to sparse arguments on amd64
 - switched amd64 uaccess.h to __chk_user_ptr()

removed bogus externs from declarations in fs/udf/*

misc annotation in drivers/video/* (nowhere near complete)

into kernel.bkbits.net:/home/davem/net-2.6

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@redhat.com>

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@redhat.com>

This enhances the network simulation scheduler to do simple random loss.

The loss parameter is a simple 32 bit value such that 0 means no loss, and
0xffffffff is always drop.  I have a new version of the tc command which takes
care of conversion from percent to this value.

Same patch for 2.4 and 2.6
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@redhat.com>

Based upon a patch from Stephen Hemminger.
Signed-off-by: David S. Miller <davem@redhat.com>

Sigh...  First of all, LSI folks have very quaint idea of existing
platforms and word sizes on those.  Their definitions of U32 and S32
should really be reserved for posterity (preferably chiseled into the
rock they have between the ears), but kernel is the wrong place for
that.  Fixed.

mptctl_do_mpt_command() was always called on userland pointers;
kernel/userland argument removed along with dead code, function
annotated, callers updated.

The rest is trivial annotations in mptctl.c and in its ioctl structures
- nothing fancy there.

Last 3 users of kernel_scsi_ioctl() eliminated; two of them used to read
partition table by issuing a READ6 via ioctl (instead of just calling
scsi_bios_ptable() as every other ->biosparam() instance does).

The last one was doing a very quaint access to fields of scsi_device by
issuing SCSI_IOCLT_GET_LUN and then shuffling bits in the result.  Down
with that insanity...

If delay scheduler decides not to send the packet right away, it requeues
it.  If the requeue fails, it should go and look again rather than waking
up prematurely.

Same patch should apply to both 2.6 and 2.4
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@redhat.com>

Trivial annotations + couple of missing (void) in prototypes