+++ /dev/null
-From 4c1c7be95c345cf2ad537a0c48e9aeadc7304527 Mon Sep 17 00:00:00 2001
-From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Date: Mon, 30 Sep 2013 13:45:08 -0700
-Subject: kernel/kmod.c: check for NULL in call_usermodehelper_exec()
-
-From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-
-commit 4c1c7be95c345cf2ad537a0c48e9aeadc7304527 upstream.
-
-If /proc/sys/kernel/core_pattern contains only "|", a NULL pointer
-dereference happens upon core dump because argv_split("") returns
-argv[0] == NULL.
-
-This bug was once fixed by commit 264b83c07a84 ("usermodehelper: check
-subprocess_info->path != NULL") but was by error reintroduced by commit
-7f57cfa4e2aa ("usermodehelper: kill the sub_info->path[0] check").
-
-This bug seems to exist since 2.6.19 (the version which core dump to
-pipe was added). Depending on kernel version and config, some side
-effect might happen immediately after this oops (e.g. kernel panic with
-2.6.32-358.18.1.el6).
-
-Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Acked-by: Oleg Nesterov <oleg@redhat.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- kernel/kmod.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/kernel/kmod.c
-+++ b/kernel/kmod.c
-@@ -420,6 +420,10 @@ int call_usermodehelper_exec(struct subp
- DECLARE_COMPLETION_ONSTACK(done);
- int retval = 0;
-
-+ if (!sub_info->path) {
-+ call_usermodehelper_freeinfo(sub_info);
-+ return -EINVAL;
-+ }
- helper_lock();
- if (!sub_info->path) {
- retval = -EINVAL;
sparc64-fix-off-by-one-in-trampoline-tlb-mapping-installation-loop.patch
sparc64-fix-not-sra-ed-o5-in-32-bit-traced-syscall.patch
sparc32-fix-exit-flag-passed-from-traced-sys_sigreturn.patch
-kernel-kmod.c-check-for-null-in-call_usermodehelper_exec.patch
usb-serial-option-ignore-card-reader-interface-on-huawei-e1750.patch
rtlwifi-align-private-space-in-rtl_priv-struct.patch
p54usb-add-usb-id-for-corega-wlusb2gtst-usb-adapter.patch
+++ /dev/null
-From 4c1c7be95c345cf2ad537a0c48e9aeadc7304527 Mon Sep 17 00:00:00 2001
-From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Date: Mon, 30 Sep 2013 13:45:08 -0700
-Subject: kernel/kmod.c: check for NULL in call_usermodehelper_exec()
-
-From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-
-commit 4c1c7be95c345cf2ad537a0c48e9aeadc7304527 upstream.
-
-If /proc/sys/kernel/core_pattern contains only "|", a NULL pointer
-dereference happens upon core dump because argv_split("") returns
-argv[0] == NULL.
-
-This bug was once fixed by commit 264b83c07a84 ("usermodehelper: check
-subprocess_info->path != NULL") but was by error reintroduced by commit
-7f57cfa4e2aa ("usermodehelper: kill the sub_info->path[0] check").
-
-This bug seems to exist since 2.6.19 (the version which core dump to
-pipe was added). Depending on kernel version and config, some side
-effect might happen immediately after this oops (e.g. kernel panic with
-2.6.32-358.18.1.el6).
-
-Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Acked-by: Oleg Nesterov <oleg@redhat.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- kernel/kmod.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/kernel/kmod.c
-+++ b/kernel/kmod.c
-@@ -568,6 +568,10 @@ int call_usermodehelper_exec(struct subp
- DECLARE_COMPLETION_ONSTACK(done);
- int retval = 0;
-
-+ if (!sub_info->path) {
-+ call_usermodehelper_freeinfo(sub_info);
-+ return -EINVAL;
-+ }
- helper_lock();
- if (!sub_info->path) {
- retval = -EINVAL;
sparc32-fix-exit-flag-passed-from-traced-sys_sigreturn.patch
mm-fix-generic-hugetlb-pte-check-return-type.patch
mm-bounce.c-fix-a-regression-where-ms_snap_stable-stable-pages-snapshotting-was-ignored.patch
-kernel-kmod.c-check-for-null-in-call_usermodehelper_exec.patch
staging-comedi-ni_65xx-bug-fix-confine-insn_bits-to-one-subdevice.patch
nfsv4.1-nfs4_fl_prepare_ds-fix-bugs-when-the-connect-attempt-fails.patch
mwifiex-fix-null-pointer-dereference-in-usb-suspend-handler.patch
+++ /dev/null
-From 4c1c7be95c345cf2ad537a0c48e9aeadc7304527 Mon Sep 17 00:00:00 2001
-From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Date: Mon, 30 Sep 2013 13:45:08 -0700
-Subject: kernel/kmod.c: check for NULL in call_usermodehelper_exec()
-
-From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-
-commit 4c1c7be95c345cf2ad537a0c48e9aeadc7304527 upstream.
-
-If /proc/sys/kernel/core_pattern contains only "|", a NULL pointer
-dereference happens upon core dump because argv_split("") returns
-argv[0] == NULL.
-
-This bug was once fixed by commit 264b83c07a84 ("usermodehelper: check
-subprocess_info->path != NULL") but was by error reintroduced by commit
-7f57cfa4e2aa ("usermodehelper: kill the sub_info->path[0] check").
-
-This bug seems to exist since 2.6.19 (the version which core dump to
-pipe was added). Depending on kernel version and config, some side
-effect might happen immediately after this oops (e.g. kernel panic with
-2.6.32-358.18.1.el6).
-
-Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Acked-by: Oleg Nesterov <oleg@redhat.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- kernel/kmod.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/kernel/kmod.c
-+++ b/kernel/kmod.c
-@@ -540,6 +540,10 @@ int call_usermodehelper_exec(struct subp
- DECLARE_COMPLETION_ONSTACK(done);
- int retval = 0;
-
-+ if (!sub_info->path) {
-+ call_usermodehelper_freeinfo(sub_info);
-+ return -EINVAL;
-+ }
- helper_lock();
- if (!sub_info->path) {
- retval = -EINVAL;
sparc64-fix-off-by-one-in-trampoline-tlb-mapping.patch
sparc64-fix-not-sra-ed-o5-in-32-bit-traced-syscall.patch
sparc32-fix-exit-flag-passed-from-traced-sys_sigreturn.patch
-kernel-kmod.c-check-for-null-in-call_usermodehelper_exec.patch
usb-serial-option-ignore-card-reader-interface-on-huawei-e1750.patch
ib_srpt-destroy-cm_id-before-destroying-qp.patch
ib_srpt-always-set-response-for-task-management.patch