OpenE2K/linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
33d7c5c1c8
linux/drivers/block
History
Dan Rosenberg 252a52aa4f Fix pktcdvd ioctl dev_minor range check 
The PKT_CTRL_CMD_STATUS device ioctl retrieves a pointer to a
pktcdvd_device from the global pkt_devs array.  The index into this
array is provided directly by the user and is a signed integer, so the
comparison to ensure that it falls within the bounds of this array will
fail when provided with a negative index.

This can be used to read arbitrary kernel memory or cause a crash due to
an invalid pointer dereference.  This can be exploited by users with
permission to open /dev/pktcdvd/control (on many distributions, this is
readable by group "cdrom").

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
[ Rather than add a cast, just make the function take the right type -Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-09-27 16:29:06 -07:00
..
aoe block: push down BKL into .open and .release 2010-08-07 18:25:34 +02:00
drbd Merge branch 'for-2.6.36' of git://git.kernel.dk/linux-2.6-block 2010-08-10 15:22:42 -07:00
paride block: push down BKL into .open and .release 2010-08-07 18:25:34 +02:00
amiflop.c block: push down BKL into .open and .release 2010-08-07 18:25:34 +02:00
ataflop.c block: push down BKL into .open and .release 2010-08-07 18:25:34 +02:00
brd.c block: push down BKL into .locked_ioctl 2010-08-07 18:25:00 +02:00
cciss_cmd.h cciss: fix hard reset code. 2010-08-07 18:52:30 +02:00
cciss_scsi.c cciss: change printks to dev_warn, etc. 2010-08-07 18:52:30 +02:00
cciss_scsi.h cciss: remove C99-style comments 2010-02-22 13:44:45 +01:00
cciss.c cciss: freeing uninitialized data on error path 2010-09-21 11:49:17 +02:00
cciss.h cciss: use consistent variable names 2010-08-07 18:52:30 +02:00
cpqarray.c cpqarray: check put_user() result 2010-08-07 18:53:03 +02:00
cpqarray.h
cryptoloop.c
DAC960.c block: push down BKL into .open and .release 2010-08-07 18:25:34 +02:00
DAC960.h
floppy.c floppy: make controller const 2010-08-07 18:52:31 +02:00
hd.c block: remove wrappers for request type/flags 2010-08-07 18:17:56 +02:00
ida_cmd.h
ida_ioctl.h
Kconfig paride: fix menu indentation 2010-05-11 09:02:55 +02:00
loop.c BLOCK: fix bio.bi_rw handling 2010-08-23 12:33:10 +02:00
Makefile The DRBD driver 2009-10-01 21:17:49 +02:00
mg_disk.c block: switch s390 tape_block and mg_disk to elevator_change() 2010-08-23 14:02:44 +02:00
nbd.c Merge branch 'for-2.6.36' of git://git.kernel.dk/linux-2.6-block 2010-08-10 15:22:42 -07:00
osdblk.c block: remove q->prepare_flush_fn completely 2010-08-07 18:24:15 +02:00
pktcdvd.c Fix pktcdvd ioctl dev_minor range check 2010-09-27 16:29:06 -07:00
ps3disk.c block: remove q->prepare_flush_fn completely 2010-08-07 18:24:15 +02:00
ps3vram.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
smart1,2.h
sunvdc.c block: Consolidate phys_segment and hw_segment limits 2010-02-26 13:58:08 +01:00
swim3.c block: push down BKL into .open and .release 2010-08-07 18:25:34 +02:00
swim_asm.S
swim.c block: push down BKL into .open and .release 2010-08-07 18:25:34 +02:00
sx8.c block: Consolidate phys_segment and hw_segment limits 2010-02-26 13:58:08 +01:00
ub.c block: push down BKL into .open and .release 2010-08-07 18:25:34 +02:00
umem.c block: unify flags for struct bio and struct request 2010-08-07 18:20:39 +02:00
umem.h
viodasd.c block: push down BKL into .open and .release 2010-08-07 18:25:34 +02:00
virtio_blk.c Merge branch 'for-2.6.36' of git://git.kernel.dk/linux-2.6-block 2010-08-10 15:22:42 -07:00
xd.c block: push down BKL into .locked_ioctl 2010-08-07 18:25:00 +02:00
xd.h
xen-blkfront.c xen: pvhvm: rename xen_emul_unplug=ignore to =unnnecessary 2010-08-23 11:59:29 +01:00
xsysace.c of: fix missing headers for of_address_to_resource() in MTD and SysACE drivers 2010-08-17 13:16:47 -06:00
z2ram.c block: push down BKL into .open and .release 2010-08-07 18:25:34 +02:00