Skip to content

L
linux
Switch branch/tag
  1. 02 Mar, 2007 2 commits
  3. 27 Feb, 2007 2 commits
  5. 26 Feb, 2007 13 commits
  7. 25 Feb, 2007 10 commits
  9. 22 Feb, 2007 5 commits
  11. 21 Feb, 2007 6 commits
  13. 20 Feb, 2007 2 commits
    • Eric Sandeen's avatar
      fix bad_inode_ops memory corruption (CVE-2006-5753) · e48d2dd4
      Eric Sandeen authored 
      CVE-2006-5753 is for a case where an inode can be marked bad, switching
the ops to bad_inode_ops, which are all connected as:

static int return_EIO(void)
{
        return -EIO;
}

#define EIO_ERROR ((void *) (return_EIO))

static struct inode_operations bad_inode_ops =
{
        .create         = bad_inode_create
...etc...

The problem here is that the void cast causes return types to not be
promoted, and for ops such as listxattr which expect more than 32 bits of
return value, the 32-bit -EIO is interpreted as a large positive 64-bit
number, i.e. 0x00000000fffffffa instead of 0xfffffffa.

This goes particularly badly when the return value is taken as a number of
bytes to copy into, say, a user's buffer for example...

I originally had coded up the fix by creating a return_EIO_<TYPE> macro
for each return type, like this:

static int return_EIO_int(void)
{
    return -EIO;
}
#define EIO_ERROR_INT ((void *) (return_EIO_int))

static struct inode_operations bad_inode_ops =
{
    .create         = EIO_ERROR_INT,
...etc...

but Al felt that it was probably better to create an EIO-returner for each
actual op signature.  Since so few ops share a signature, I just went ahead
& created an EIO function for each individual file & inode op that returns
a value.

Adrian Bunk:
backported to 2.6.16
Signed-off-by: default avatarEric Sandeen <sandeen@redhat.com>
Signed-off-by: default avatarAdrian Bunk <bunk@stusta.de>
      e48d2dd4
    • Marcel Holtmann's avatar
      [Bluetooth] Restrict well known PSM to privileged users · 82ea2673
      Marcel Holtmann authored 
      The PSM values below 0x1001 of L2CAP are reserved for well known
services. Restrict the possibility to bind them to privileged
users.
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarAdrian Bunk <bunk@stusta.de>
      82ea2673
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7