Dave Jones 1743889816 gdth: Prevent negative offsets in ioctl CVE-2009-3080 ...

commit 690e744869f3262855b83b4fb59199cf142765b0 upstream.

A negative offset could be used to index before the event buffer and
lead to a security breach.

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2009-12-08 10:20:55 -08:00

..

aacraid

Replace all DMA_nBIT_MASK macro with DMA_BIT_MASK(n)

2009-04-13 15:04:33 -07:00

aic7xxx

[SCSI] aic79xx: make driver respect nvram for IU and QAS settings

2009-06-15 10:09:35 -05:00

aic7xxx_old

…

aic94xx

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

arcmsr

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

arm

Merge branch 'master' into devel

2009-03-28 20:30:18 +00:00

bnx2i

cnic: add NETDEV_1000 and NETDEVICES to Kconfig select

2009-06-21 11:02:59 -05:00

cxgb3i

Merge git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fixes

2009-07-04 09:46:01 -07:00

device_handler

[SCSI] scsi_dh_rdac: Retry for NOT_READY(02/04/01) in rdac device handler

2009-05-20 17:21:14 -05:00

dpt

trivial: fix typo milisecond/millisecond for documentation and source comments.

2009-06-12 18:01:46 +02:00

fcoe

libfcoe: Add runtime debugging with module param debug_logging

2009-06-21 11:07:06 -05:00

fnic

[SCSI] fnic: use DMA_BIT_MASK(nn) instead of deprecated DMA_nnBIT_MASK

2009-06-25 11:08:53 -05:00

ibmvscsi

[SCSI] ibmvscsi: Fix module load hang

2009-06-25 11:06:41 -05:00

libfc

[SCSI] libfc: fix a circular locking warning during sending RRQ

2009-07-30 08:50:02 -05:00

libsas

[SCSI] libsas: fix wide port hotplug issues

2009-07-30 09:54:39 -05:00

lpfc

Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6

2009-06-17 09:50:44 -07:00

megaraid

trivial: typo (en|dis|avail|remove)bale -> (en|dis|avail|remove)able

2009-06-12 18:01:45 +02:00

mpt2sas

mpt2sas: Raid 10 Volume is showing as Raid 1E in dmesg

2009-09-24 08:43:49 -07:00

mvsas

[SCSI] mvsas: remove all the casts from void * or to void *

2009-05-23 15:44:13 -05:00

osd

[SCSI] Merge branch 'linus'

2009-06-12 10:02:03 -05:00

pcmcia

[SCSI] nsp_cs: time_out reaches -1

2009-06-15 10:09:31 -05:00

qla2xxx

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

qla4xxx

[SCSI] qla4xxx: Remove hiwat code so scsi eh does not get escalated when we can make progress

2009-07-30 08:50:01 -05:00

sym53c8xx_2

sym53c8xx: ratelimit parity errors

2009-06-21 11:12:17 -05:00

.gitignore

…

3w-9xxx.c

[SCSI] 3w-9xxx: scsi_dma_unmap fix

2009-05-15 12:23:32 -04:00

3w-9xxx.h

[SCSI] 3w-9xxx: add power management support

2009-03-13 15:46:42 -05:00

3w-xxxx.c

[SCSI] 3w-xxxx: scsi_dma_unmap fix

2009-05-15 12:24:59 -04:00

3w-xxxx.h

[SCSI] 3w-xxxx: scsi_dma_unmap fix

2009-05-15 12:24:59 -04:00

53c700_d.h_shipped

…

53c700.c

…

53c700.h

…

53c700.scr

…

a100u2w.c

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

a100u2w.h

…

a2091.c

[SCSI] a2091: make 2 functions static

2009-04-03 10:17:31 -05:00

a2091.h

[SCSI] a2091: make 2 functions static

2009-04-03 10:17:31 -05:00

a3000.c

[SCSI] a3000: make 2 functions static

2009-04-03 10:17:17 -05:00

a3000.h

[SCSI] a3000: make 2 functions static

2009-04-03 10:17:17 -05:00

a4000t.c

scsi: a4000 - Correct driver unregistration in case of failure

2009-04-22 20:39:06 +02:00

advansys.c

[SCSI] advansys: use request_firmware

2009-04-03 09:25:23 -05:00

aha152x.c

drivers/scsi: use nr_irqs

2008-10-16 16:52:06 +02:00

aha152x.h

…

aha1542.c

…

aha1542.h

…

aha1740.c

scsi: remove driver_data direct access of struct device

2009-06-15 21:30:27 -07:00

aha1740.h

…

aic7xxx_old.c

…

atari_NCR5380.c

Remove multiple KERN_ prefixes from printk formats

2009-07-08 10:30:03 -07:00

atari_scsi.c

m68k: section mismatch fixes: Atari SCSI

2009-03-26 21:15:29 +01:00

atari_scsi.h

…

atp870u.c

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

atp870u.h

…

BusLogic.c

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

BusLogic.h

…

bvme6000_scsi.c

scsi/m68k: Kill NCR_700_detect() warnings

2009-03-24 16:38:25 -07:00

ch.c

[SCSI] ch: Add scsi type modalias

2009-03-13 15:48:43 -05:00

constants.c

[SCSI] Remove SUGGEST flags

2009-03-12 12:58:02 -05:00

dc395x.c

…

dc395x.h

…

dmx3191d.c

…

dpt_i2o.c

dpt_i2o: Fix typo of EINVAL

2009-11-09 16:22:15 -08:00

dpti.h

…

dtc.c

…

dtc.h

…

eata_generic.h

…

eata_pio.c

[SCSI] Clean up my email address and use a single standard address for everything

2008-12-29 11:24:12 -06:00

eata_pio.h

…

eata.c

block: convert to pos and nr_sectors accessors

2009-05-11 09:50:54 +02:00

esp_scsi.c

[SCSI] esp_scsi: Use DIV_ROUND_UP

2008-12-29 11:24:14 -06:00

esp_scsi.h

sparc: Kill SBUS DVMA layer.

2008-08-29 02:13:10 -07:00

fd_mcs.c

…

fdomain.c

[SCSI] Clean up my email address and use a single standard address for everything

2008-12-29 11:24:12 -06:00

fdomain.h

…

FlashPoint.c

…

g_NCR5380_mmio.c

…

g_NCR5380.c

…

g_NCR5380.h

…

gdth_ioctl.h

…

gdth_proc.c

[SCSI] gdth: fix overlapping snprintf users

2009-06-09 10:31:46 -05:00

gdth_proc.h

block: unify request timeout handling

2008-10-09 08:56:13 +02:00

gdth.c

gdth: Prevent negative offsets in ioctl CVE-2009-3080

2009-12-08 10:20:55 -08:00

gdth.h

block: unify request timeout handling

2008-10-09 08:56:13 +02:00

gvp11.c

[SCSI] a2091, gvp11: kill warn_unused_result warnings

2009-01-02 12:16:18 -06:00

gvp11.h

…

hosts.c

fix race that can give duplicate host number

2009-06-21 10:52:42 -05:00

hptiop.c

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

hptiop.h

…

ibmmca.c

[SCSI] Clean up my email address and use a single standard address for everything

2008-12-29 11:24:12 -06:00

imm.c

[SCSI] replace __FUNCTION__ with __func__

2008-07-27 10:31:49 -04:00

imm.h

…

in2000.c

[SCSI] Clean up my email address and use a single standard address for everything

2008-12-29 11:24:12 -06:00

in2000.h

…

initio.c

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

initio.h

[SCSI] Clean up my email address and use a single standard address for everything

2008-12-29 11:24:12 -06:00

ipr.c

ipr: differentiate pci-x and pci-e based adapters

2009-06-21 10:52:47 -05:00

ipr.h

ipr: differentiate pci-x and pci-e based adapters

2009-06-21 10:52:47 -05:00

ips.c

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

ips.h

removed unused #include <linux/version.h>'s

2008-08-23 12:14:12 -07:00

iscsi_tcp.c

iscsi_tcp: propogate EAGAIN from sendpage to libiscsi

2009-06-21 10:52:40 -05:00

iscsi_tcp.h

[SCSI] iscsi_tcp: hook iscsi_tcp into new libiscsi_tcp module

2008-12-29 11:24:22 -06:00

jazz_esp.c

…

Kconfig

explain the hidden scsi_wait_scan Kconfig variable

2009-06-21 11:10:41 -05:00

lasi700.c

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

libiscsi_tcp.c

libiscsi: don't run scsi eh if iscsi task is making progress

2009-06-21 10:52:39 -05:00

libiscsi.c

[SCSI] libiscsi: disable bh in and abort handler.

2009-07-30 08:49:59 -05:00

libsrp.c

SCSI: libsrp: fix memory leak in srp_ring_free()

2009-09-24 08:43:50 -07:00

mac53c94.c

Remove multiple KERN_ prefixes from printk formats

2009-07-08 10:30:03 -07:00

mac53c94.h

…

mac_esp.c

[SCSI] mac_esp: fix for quadras with two esp chips

2008-12-29 11:24:19 -06:00

mac_scsi.c

m68k: machw.h cleanup

2008-12-28 20:00:03 +01:00

mac_scsi.h

…

Makefile

[SCSI] bnx2i: Add bnx2i iSCSI driver.

2009-06-09 10:22:45 -05:00

megaraid.c

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

megaraid.h

trivial: typo (en|dis|avail|remove)bale -> (en|dis|avail|remove)able

2009-06-12 18:01:45 +02:00

mesh.c

[SCSI] SCSI: remove dev->power.power_state from mesh driver

2008-06-05 09:23:44 -05:00

mesh.h

…

mvme16x_scsi.c

scsi/m68k: Kill NCR_700_detect() warnings

2009-03-24 16:38:25 -07:00

mvme147.c

…

mvme147.h

…

ncr53c8xx.c

[SCSI] ncr53c8xx: div reaches -1

2009-06-15 10:09:30 -05:00

ncr53c8xx.h

…

NCR53c406a.c

…

NCR5380.c

[SCSI] Clean up my email address and use a single standard address for everything

2008-12-29 11:24:12 -06:00

NCR5380.h

…

NCR_D700.c

[SCSI] NCR_D700: fix IRQ handler return type

2009-05-23 15:44:09 -05:00

NCR_D700.h

…

NCR_Q720.c

…

NCR_Q720.h

…

nsp32_debug.c

[SCSI] replace __FUNCTION__ with __func__

2008-07-27 10:31:49 -04:00

nsp32_io.h

…

nsp32.c

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

nsp32.h

removed unused #include <linux/version.h>'s

2008-08-23 12:14:12 -07:00

osst_detect.h

…

osst_options.h

…

osst.c

[SCSI] osst: replace scsi_execute_async with the block layer API

2009-03-12 12:58:10 -05:00

osst.h

[SCSI] osst: replace scsi_execute_async with the block layer API

2009-03-12 12:58:10 -05:00

pas16.c

…

pas16.h

…

ppa.c

[SCSI] replace __FUNCTION__ with __func__

2008-07-27 10:31:49 -04:00

ppa.h

…

ps3rom.c

ps3rom: Use ps3_system_bus_[gs]et_drvdata() instead of direct access

2009-06-16 14:15:46 +10:00

qla1280.c

[SCSI] qla1280: error recovery rewrite

2009-05-20 17:21:13 -05:00

qla1280.h

[SCSI] qla1280: error recovery rewrite

2009-05-20 17:21:13 -05:00

qlogicfas408.c

[SCSI] Clean up my email address and use a single standard address for everything

2008-12-29 11:24:12 -06:00

qlogicfas408.h

…

qlogicfas.c

…

qlogicpti.c

[SCSI] qlogicpti: use request_firmware

2009-04-03 09:25:23 -05:00

qlogicpti.h

qlogicpti: Convert to pure OF driver.

2008-08-29 02:14:46 -07:00

raid_class.c

[SCSI] struct device - replace bus_id with dev_name(), dev_set_name()

2009-01-02 10:22:16 -06:00

script_asm.pl

…

scsi_debug.c

scsi_debug: Add support for physical block exponent and alignment

2009-06-21 11:03:54 -05:00

scsi_devinfo.c

enhance device info matching for multiple tables

2009-06-21 10:52:45 -05:00

scsi_error.c

SCSI: Retry ADD_TO_MLQUEUE return value for EH commands

2009-10-22 15:11:44 -07:00

scsi_ioctl.c

[SCSI] struct device - replace bus_id with dev_name(), dev_set_name()

2009-01-02 10:22:16 -06:00

scsi_lib_dma.c

…

scsi_lib.c

sd, sr: fix Driver 'sd' needs updating message

2009-06-21 12:01:27 -05:00

scsi_logging.h

…

scsi_module.c

…

scsi_netlink.c

[SCSI] fix netlink kernel-doc

2008-10-23 11:42:17 -05:00

scsi_priv.h

sd, sr: fix Driver 'sd' needs updating message

2009-06-21 12:01:27 -05:00

scsi_proc.c

proc 2/2: remove struct proc_dir_entry::owner

2009-03-31 01:14:44 +04:00

scsi_sas_internal.h

…

scsi_scan.c

[SCSI] Increase default timeout for INQUIRY

2009-05-20 17:21:13 -05:00

scsi_sysctl.c

…

scsi_sysfs.c

sd, sr: fix Driver 'sd' needs updating message

2009-06-21 12:01:27 -05:00

scsi_tgt_if.c

scsi-tgt: BKL pushdown

2008-07-02 15:06:25 -06:00

scsi_tgt_lib.c

block: cleanup rq->data_len usages

2009-05-11 09:50:55 +02:00

scsi_tgt_priv.h

[SCSI] replace __FUNCTION__ with __func__

2008-07-27 10:31:49 -04:00

scsi_transport_api.h

…

scsi_transport_fc_internal.h

…

scsi_transport_fc.c

[SCSI] FC transport: Locking fix for common-code FC pass-through patch

2009-06-26 10:29:48 -05:00

scsi_transport_iscsi.c

iscsi: Use GFP_ATOMIC in iscsi_offload_mesg().

2009-07-30 11:05:03 -07:00

scsi_transport_sas.c

scsi_transport_sas: needs to call blk_end_request_all for SMP requests

2009-06-21 10:52:41 -05:00

scsi_transport_spi.c

scsi_transport_spi: Blacklist Ultrium-3 tape for IU transfers

2009-06-21 10:52:46 -05:00

scsi_transport_srp_internal.h

…

scsi_transport_srp.c

[SCSI] struct device - replace bus_id with dev_name(), dev_set_name()

2009-01-02 10:22:16 -06:00

scsi_typedefs.h

…

scsi_wait_scan.c

driver synchronization: make scsi_wait_scan more advanced

2009-04-21 19:40:00 -07:00

scsi.c

SCSI: Fix protection scsi_data_buffer leak

2009-10-22 15:11:44 -07:00

scsi.h

…

scsicam.c

…

sd_dif.c

block: convert to pos and nr_sectors accessors

2009-05-11 09:50:54 +02:00

sd.c

SCSI: fix oops during scsi scanning

2009-09-24 08:43:50 -07:00

sd.h

sd: Physical block size and alignment support

2009-06-21 10:52:37 -05:00

ses.c

[SCSI] ses: #if 0 the unused ses_match_host()

2009-04-03 10:17:01 -05:00

sg.c

SCSI: sg: Free data buffers after calling blk_rq_unmap_user

2009-10-22 15:11:45 -07:00

sgiwd93.c

[SCSI] sgiwd93: Fix compilation warning

2009-01-02 10:58:41 -06:00

sim710.c

[SCSI] struct device - replace bus_id with dev_name(), dev_set_name()

2009-01-02 10:22:16 -06:00

sni_53c710.c

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

sr_ioctl.c

[SCSI] sr: report more accurate drive status after closing the tray.

2009-04-27 09:32:30 -05:00

sr_vendor.c

drivers/scsi/sr_vendor.c: use bcd2bin

2008-10-20 08:52:41 -07:00

sr.c

sd, sr: fix Driver 'sd' needs updating message

2009-06-21 12:01:27 -05:00

sr.h

…

st_options.h

…

st.c

[SCSI] Merge branch 'linus'

2009-06-12 10:02:03 -05:00

st.h

[SCSI] st: remove unused frp_sg_current

2009-01-02 12:02:25 -06:00

stex.c

dma-mapping: replace all DMA_32BIT_MASK macro with DMA_BIT_MASK(32)

2009-04-07 08:31:11 -07:00

sun3_NCR5380.c

Remove multiple KERN_ prefixes from printk formats

2009-07-08 10:30:03 -07:00

sun3_scsi_vme.c

…

sun3_scsi.c

…

sun3_scsi.h

…

sun3x_esp.c

[SCSI] sun3x_esp: Convert && to ||

2008-10-23 11:42:19 -05:00

sun_esp.c

sparc: Annotate of_device_id arrays with const or __initdata.

2008-08-31 01:23:17 -07:00

sym53c416.c

[SCSI] Clean up my email address and use a single standard address for everything

2008-12-29 11:24:12 -06:00

sym53c416.h

…

t128.c

…

t128.h

…

tmscsim.c

[SCSI] tmscsim: fix indentation and braces disagreement - add braces

2008-12-29 11:24:14 -06:00

tmscsim.h

…

u14-34f.c

block: convert to pos and nr_sectors accessors

2009-05-11 09:50:54 +02:00

ultrastor.c

…

ultrastor.h

…

wd33c93.c

…

wd33c93.h

…

wd7000.c

[SCSI] Clean up my email address and use a single standard address for everything

2008-12-29 11:24:12 -06:00

zalon.c

[SCSI] zalon: fix oops on attach failure

2009-06-25 11:37:23 -05:00

zorro7xx.c

…