2.6.22.8 release

diff --git a/releases/2.6.22.8/convert-snd-page-alloc-proc-file-to-use-seq_file.patch b/releases/2.6.22.8/convert-snd-page-alloc-proc-file-to-use-seq_file.patch
new file mode 100644 (file)
index 0000000..6b518b3
--- /dev/null
+++ b/releases/2.6.22.8/convert-snd-page-alloc-proc-file-to-use-seq_file.patch
@@ -0,0 +1,164 @@
+From ccec6e2c4a74adf76ed4e2478091a311b1806212 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 17 Sep 2007 21:55:10 +0200
+Subject: Convert snd-page-alloc proc file to use seq_file (CVE-2007-4571)
+
+changeset ccec6e2c4a74adf76ed4e2478091a311b1806212 in mainline.
+
+Use seq_file for the proc file read/write of snd-page-alloc module.
+This automatically fixes bugs in the old proc code.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+
+diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c
+index f057430..9b5656d 100644
+--- a/sound/core/memalloc.c
++++ b/sound/core/memalloc.c
+@@ -27,6 +27,7 @@
+ #include <linux/pci.h>
+ #include <linux/slab.h>
+ #include <linux/mm.h>
++#include <linux/seq_file.h>
+ #include <asm/uaccess.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/moduleparam.h>
+@@ -481,53 +482,54 @@ static void free_all_reserved_pages(void)
+ #define SND_MEM_PROC_FILE     "driver/snd-page-alloc"
+ static struct proc_dir_entry *snd_mem_proc;
+ 
+-static int snd_mem_proc_read(char *page, char **start, off_t off,
+-                           int count, int *eof, void *data)
++static int snd_mem_proc_read(struct seq_file *seq, void *offset)
+ {
+-      int len = 0;
+       long pages = snd_allocated_pages >> (PAGE_SHIFT-12);
+       struct snd_mem_list *mem;
+       int devno;
+       static char *types[] = { "UNKNOWN", "CONT", "DEV", "DEV-SG", "SBUS" };
+ 
+       mutex_lock(&list_mutex);
+-      len += snprintf(page + len, count - len,
+-                      "pages  : %li bytes (%li pages per %likB)\n",
+-                      pages * PAGE_SIZE, pages, PAGE_SIZE / 1024);
++      seq_printf(seq, "pages  : %li bytes (%li pages per %likB)\n",
++                 pages * PAGE_SIZE, pages, PAGE_SIZE / 1024);
+       devno = 0;
+       list_for_each_entry(mem, &mem_list_head, list) {
+               devno++;
+-              len += snprintf(page + len, count - len,
+-                              "buffer %d : ID %08x : type %s\n",
+-                              devno, mem->id, types[mem->buffer.dev.type]);
+-              len += snprintf(page + len, count - len,
+-                              "  addr = 0x%lx, size = %d bytes\n",
+-                              (unsigned long)mem->buffer.addr, (int)mem->buffer.bytes);
++              seq_printf(seq, "buffer %d : ID %08x : type %s\n",
++                         devno, mem->id, types[mem->buffer.dev.type]);
++              seq_printf(seq, "  addr = 0x%lx, size = %d bytes\n",
++                         (unsigned long)mem->buffer.addr,
++                         (int)mem->buffer.bytes);
+       }
+       mutex_unlock(&list_mutex);
+-      return len;
++      return 0;
++}
++
++static int snd_mem_proc_open(struct inode *inode, struct file *file)
++{
++      return single_open(file, snd_mem_proc_read, NULL);
+ }
+ 
+ /* FIXME: for pci only - other bus? */
+ #ifdef CONFIG_PCI
+ #define gettoken(bufp) strsep(bufp, " \t\n")
+ 
+-static int snd_mem_proc_write(struct file *file, const char __user *buffer,
+-                            unsigned long count, void *data)
++static ssize_t snd_mem_proc_write(struct file *file, const char __user * buffer,
++                                size_t count, loff_t * ppos)
+ {
+       char buf[128];
+       char *token, *p;
+ 
+-      if (count > ARRAY_SIZE(buf) - 1)
+-              count = ARRAY_SIZE(buf) - 1;
++      if (count > sizeof(buf) - 1)
++              return -EINVAL;
+       if (copy_from_user(buf, buffer, count))
+               return -EFAULT;
+-      buf[ARRAY_SIZE(buf) - 1] = '\0';
++      buf[count] = '\0';
+ 
+       p = buf;
+       token = gettoken(&p);
+       if (! token || *token == '#')
+-              return (int)count;
++              return count;
+       if (strcmp(token, "add") == 0) {
+               char *endp;
+               int vendor, device, size, buffers;
+@@ -548,7 +550,7 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer,
+                   (buffers = simple_strtol(token, NULL, 0)) <= 0 ||
+                   buffers > 4) {
+                       printk(KERN_ERR "snd-page-alloc: invalid proc write format\n");
+-                      return (int)count;
++                      return count;
+               }
+               vendor &= 0xffff;
+               device &= 0xffff;
+@@ -560,7 +562,7 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer,
+                               if (pci_set_dma_mask(pci, mask) < 0 ||
+                                   pci_set_consistent_dma_mask(pci, mask) < 0) {
+                                       printk(KERN_ERR "snd-page-alloc: cannot set DMA mask %lx for pci %04x:%04x\n", mask, vendor, device);
+-                                      return (int)count;
++                                      return count;
+                               }
+                       }
+                       for (i = 0; i < buffers; i++) {
+@@ -570,7 +572,7 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer,
+                                                       size, &dmab) < 0) {
+                                       printk(KERN_ERR "snd-page-alloc: cannot allocate buffer pages (size = %d)\n", size);
+                                       pci_dev_put(pci);
+-                                      return (int)count;
++                                      return count;
+                               }
+                               snd_dma_reserve_buf(&dmab, snd_dma_pci_buf_id(pci));
+                       }
+@@ -596,9 +598,21 @@ static int snd_mem_proc_write(struct file *file, const char __user *buffer,
+               free_all_reserved_pages();
+       else
+               printk(KERN_ERR "snd-page-alloc: invalid proc cmd\n");
+-      return (int)count;
++      return count;
+ }
+ #endif /* CONFIG_PCI */
++
++static const struct file_operations snd_mem_proc_fops = {
++      .owner          = THIS_MODULE,
++      .open           = snd_mem_proc_open,
++      .read           = seq_read,
++#ifdef CONFIG_PCI
++      .write          = snd_mem_proc_write,
++#endif
++      .llseek         = seq_lseek,
++      .release        = single_release,
++};
++
+ #endif /* CONFIG_PROC_FS */
+ 
+ /*
+@@ -609,12 +623,8 @@ static int __init snd_mem_init(void)
+ {
+ #ifdef CONFIG_PROC_FS
+       snd_mem_proc = create_proc_entry(SND_MEM_PROC_FILE, 0644, NULL);
+-      if (snd_mem_proc) {
+-              snd_mem_proc->read_proc = snd_mem_proc_read;
+-#ifdef CONFIG_PCI
+-              snd_mem_proc->write_proc = snd_mem_proc_write;
+-#endif
+-      }
++      if (snd_mem_proc)
++              snd_mem_proc->proc_fops = &snd_mem_proc_fops;
+ #endif
+       return 0;
+ }