[kernel] r14110 - in dists/sid/linux-2.6/debian: . patches/bugfix/parisc patches/series
Dann Frazier
dannf at alioth.debian.org
Fri Aug 14 23:50:53 UTC 2009
Author: dannf
Date: Fri Aug 14 23:50:51 2009
New Revision: 14110
Log:
[parisc] isa-eeprom - Fix loff_t usage
Added:
dists/sid/linux-2.6/debian/patches/bugfix/parisc/isa-eeprom-fix-loff_t-usage.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/6
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog Fri Aug 14 23:47:02 2009 (r14109)
+++ dists/sid/linux-2.6/debian/changelog Fri Aug 14 23:50:51 2009 (r14110)
@@ -6,6 +6,7 @@
[ dann frazier ]
* Make sock_sendpage() use kernel_sendpage() (CVE-2009-2692)
* flat: fix uninitialized ptr with shared libs
+ * [parisc] isa-eeprom - Fix loff_t usage
-- Bastian Blank <waldi at debian.org> Fri, 14 Aug 2009 23:50:45 +0200
Added: dists/sid/linux-2.6/debian/patches/bugfix/parisc/isa-eeprom-fix-loff_t-usage.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/sid/linux-2.6/debian/patches/bugfix/parisc/isa-eeprom-fix-loff_t-usage.patch Fri Aug 14 23:50:51 2009 (r14110)
@@ -0,0 +1,28 @@
+commit 6b4dbcd86a9d464057fcc7abe4d0574093071fcc
+Author: Michael Buesch <mb at bu3sch.de>
+Date: Mon Jul 20 22:58:44 2009 +0000
+
+ parisc: isa-eeprom - Fix loff_t usage
+
+ loff_t is a signed type. If userspace passes a negative ppos, the "count"
+ range check is weakened. "count"s bigger than HPEE_MAX_LENGTH will pass the check.
+ Also, if ppos is negative, the readb(eisa_eeprom_addr + *ppos) will poke in random
+ memory.
+
+ Signed-off-by: Michael Buesch <mb at bu3sch.de>
+ Cc: stable at kernel.org
+ Signed-off-by: Helge Deller <deller at gmx.de>
+
+diff --git a/drivers/parisc/eisa_eeprom.c b/drivers/parisc/eisa_eeprom.c
+index 685d94e..8c0b26e 100644
+--- a/drivers/parisc/eisa_eeprom.c
++++ b/drivers/parisc/eisa_eeprom.c
+@@ -55,7 +55,7 @@ static ssize_t eisa_eeprom_read(struct file * file,
+ ssize_t ret;
+ int i;
+
+- if (*ppos >= HPEE_MAX_LENGTH)
++ if (*ppos < 0 || *ppos >= HPEE_MAX_LENGTH)
+ return 0;
+
+ count = *ppos + count < HPEE_MAX_LENGTH ? count : HPEE_MAX_LENGTH - *ppos;
Modified: dists/sid/linux-2.6/debian/patches/series/6
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/6 Fri Aug 14 23:47:02 2009 (r14109)
+++ dists/sid/linux-2.6/debian/patches/series/6 Fri Aug 14 23:50:51 2009 (r14110)
@@ -1,2 +1,3 @@
+ bugfix/all/make-sock_sendpage-use-kernel_sendpage.patch
+ bugfix/all/flat-fix-uninitialized-ptr-with-shared-libs.patch
++ bugfix/parisc/isa-eeprom-fix-loff_t-usage.patch
More information about the Kernel-svn-changes
mailing list