Skip to content

GitLab

Switch branch/tag
  1. 02 May, 2007 3 commits
  3. 26 Apr, 2007 1 commit
  5. 27 Mar, 2007 1 commit
  7. 08 Dec, 2006 1 commit
  9. 07 Dec, 2006 2 commits
  11. 11 Oct, 2006 1 commit
    • Maciej W. Rozycki's avatar
      [PATCH] 32-bit compatibility HDIO IOCTLs · 39484e53
      Maciej W. Rozycki authored 
      
A couple of HDIO IOCTLs are not yet handled and a few others are marked
as using a pointer rather than an unsigned long.  The formers include:

HDIO_GET_WCACHE, HDIO_GET_ACOUSTIC, HDIO_GET_ADDRESS and
HDIO_GET_BUSSTATE.  The latters are: HDIO_SET_MULTCOUNT,
HDIO_SET_UNMASKINTR, HDIO_SET_KEEPSETTINGS, HDIO_SET_32BIT,
HDIO_SET_NOWERR, HDIO_SET_DMA, HDIO_SET_PIO_MODE and HDIO_SET_NICE.

Additionally 0x330 used to be HDIO_GETGEO_BIG and may be issued by 32-bit
`hdparm' run on a 64-bit kernel making Linux complain loudly.

This is a fix for these issues.
Signed-off-by: default avatarMaciej W. Rozycki <macro@linux-mips.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Acked-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      39484e53
  13. 01 Oct, 2006 1 commit
  15. 30 Sep, 2006 8 commits
  17. 30 Jun, 2006 1 commit
  19. 26 Jun, 2006 2 commits
  21. 25 Jun, 2006 1 commit
  23. 24 Mar, 2006 1 commit
  25. 23 Mar, 2006 1 commit
  27. 09 Mar, 2006 1 commit
    • Randy Dunlap's avatar
      [NET] compat ifconf: fix limits · 1efa3c05
      Randy Dunlap authored 
      
A recent change to compat. dev_ifconf() in fs/compat_ioctl.c
causes ifconf data to be truncated 1 entry too early when copying it
to userspace.  The correct amount of data (length) is returned,
but the final entry is empty (zero, not filled in).
The for-loop 'i' check should use <= to allow the final struct
ifreq32 to be copied.  I also used the ifconf-corruption program
in kernel bugzilla #4746 to make sure that this change does not
re-introduce the corruption.
Signed-off-by: default avatarRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1efa3c05
  29. 26 Feb, 2006 1 commit
  31. 08 Feb, 2006 1 commit
  33. 12 Jan, 2006 3 commits
  35. 10 Jan, 2006 2 commits
    • Christoph Hellwig's avatar
      [PATCH] sanitize building of fs/compat_ioctl.c · e6a6d2ef
      Christoph Hellwig authored 
      
Now that all these entries in the arch ioctl32.c files are gone [1], we can
build fs/compat_ioctl.c as a normal object and kill tons of cruft.  We need a
special do_ioctl32_pointer handler for s390 so the compat_ptr call is done.
This is not needed but harmless on all other architectures.  Also remove some
superflous includes in fs/compat_ioctl.c

Tested on ppc64.

[1] parisc still had it's PPP handler left, which is not fully correct
    for ppp and besides that ppp uses the generic SIOCPRIV ioctl so it'd
    kick in for all netdevice users.  We can introduce a proper handler
    in one of the next patch series by adding a compat_ioctl method to
    struct net_device but for now let's just kill it - parisc doesn't
    compile in mainline anyway and I don't want this to block this
    patchset.
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Cc: Matthew Wilcox <willy@debian.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      e6a6d2ef
    • Christoph Hellwig's avatar
      [PATCH] move rtc compat ioctl handling to fs/compat_ioctl.c · ec3cad96
      Christoph Hellwig authored 
      
This patch implements generic handling of RTC_IRQP_READ32, RTC_IRQP_SET32,
RTC_EPOCH_READ32 and RTC_EPOCH_SET32 in fs/compat_ioctl.c.  It's based on the
x86_64 code which needed a little massaging to be endian-clean.

parisc used COMPAT_IOCTL or generic w_long handlers for these whichce is wrong
and can't work because the ioctls encode sizeof(unsigned long) in their ioctl
number.  parisc also duplicated COMPAT_IOCTL entries for other rtc ioctls
which I remove in this patch, too.
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Acked-by: default avatarMatthew Wilcox <matthew@wil.cx>
Acked-by: default avatar"David S. Miller" <davem@davemloft.net>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      ec3cad96
  37. 09 Jan, 2006 1 commit
    • Arnd Bergmann's avatar
      V4L (926_2): Moves compat32 functions from fs to v4l subsystem · 0d0fbf81
      Arnd Bergmann authored 
      
This moves the 32 bit ioctl compatibility handlers for
Video4Linux into a new file and adds explicit calls to them
to each v4l device driver.

Unfortunately, there does not seem to be any code handling
the v4l2 ioctls, so quite often the code goes through two
separate conversions, first from 32 bit v4l to 64 bit v4l,
and from there to 64 bit v4l2. My patch does not change
that, so there is still much room for improvement.

Also, some drivers have additional ioctl numbers, for
which the conversion should be handled internally to
that driver.
Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@brturbo.com.br>
      0d0fbf81
  39. 20 Nov, 2005 1 commit
    • Alexandra Kossovsky's avatar
      [COMPAT] net: SIOCGIFCONF data corruption · 4909724b
      Alexandra Kossovsky authored 
      From: Alexandra Kossovsky <Alexandra.Kossovsky@oktetlabs.ru>

From http://bugzilla.kernel.org/show_bug.cgi?id=4746



There is user data corruption when using ioctl(SIOCGIFCONF) in 32-bit
application running amd64 kernel. I do not think that this problem is
exploitable, but any data corruption may lead to security problems.
Following code demonstrates the problem

#include <stdint.h>
#include <stdio.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <net/if.h>
#include <sys/ioctl.h>

char buf[256];

main()
{
	int s = socket(AF_INET, SOCK_DGRAM, 0);
	struct ifconf req;
	int i;

	req.ifc_buf = buf;
	req.ifc_len = 41;

	printf("Result %d\n", ioctl(s, SIOCGIFCONF, &req));
	printf("Len %d\n", req.ifc_len);
	for (i = 41; i < 256; i++)
		if (buf[i] != 0)
			printf("Byte %d is corrupted\n", i);
}
	
Steps to reproduce:
Compile the code above into 32-bit elf and run it. You'll get
Result 0
Len 32
Byte 48 is corrupted
Byte 52 is corrupted
Byte 53 is corrupted
Byte 54 is corrupted
Byte 55 is corrupted
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4909724b
  41. 18 Nov, 2005 1 commit
  43. 17 Nov, 2005 1 commit
  45. 16 Nov, 2005 1 commit
  47. 09 Nov, 2005 2 commits
  49. 07 Nov, 2005 1 commit