1. 10 Jul, 2007 1 commit
  2. 08 May, 2007 1 commit
  3. 12 Feb, 2007 1 commit
  4. 06 Jan, 2007 1 commit
    • Eric Sandeen's avatar
      [PATCH] fix memory corruption from misinterpreted bad_inode_ops return values · be6aab0e
      Eric Sandeen authored
      
      CVE-2006-5753 is for a case where an inode can be marked bad, switching
      the ops to bad_inode_ops, which are all connected as:
      
      static int return_EIO(void)
      {
              return -EIO;
      }
      
      #define EIO_ERROR ((void *) (return_EIO))
      
      static struct inode_operations bad_inode_ops =
      {
              .create         = bad_inode_create
      ...etc...
      
      The problem here is that the void cast causes return types to not be
      promoted, and for ops such as listxattr which expect more than 32 bits of
      return value, the 32-bit -EIO is interpreted as a large positive 64-bit
      number, i.e. 0x00000000fffffffa instead of 0xfffffffa.
      
      This goes particularly badly when the return value is taken as a number of
      bytes to copy into, say, a user's buffer for example...
      
      I originally had coded up the fix by creating a return_EIO_<TYPE> macro
      for each return type, like this:
      
      static int return_EIO_int(void)
      {
      	return -EIO;
      }
      #define EIO_ERROR_INT ((void *) (return_EIO_int))
      
      static struct inode_operations bad_inode_ops =
      {
      	.create		= EIO_ERROR_INT,
      ...etc...
      
      but Al felt that it was probably better to create an EIO-returner for each
      actual op signature.  Since so few ops share a signature, I just went ahead
      & created an EIO function for each individual file & inode op that returns
      a value.
      Signed-off-by: default avatarEric Sandeen <sandeen@redhat.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      be6aab0e
  5. 01 Oct, 2006 1 commit
  6. 28 Mar, 2006 1 commit
  7. 05 May, 2005 1 commit
  8. 16 Apr, 2005 1 commit
    • Linus Torvalds's avatar
      Linux-2.6.12-rc2 · 1da177e4
      Linus Torvalds authored
      Initial git repository build. I'm not bothering with the full history,
      even though we have it. We can create a separate "historical" git
      archive of that later if we want to, and in the meantime it's about
      3.2GB when imported into git - space that would just make the early
      git days unnecessarily complicated, when we don't have a lot of good
      infrastructure for it.
      
      Let it rip!
      1da177e4