From fb7aa9c8889ea20a1f69f22db74e9f9696aeba5c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 12 Dec 2008 00:03:26 -0800 Subject: [PATCH] 2 more patches. --- ...user-ioctl-range-and-an-error-return.patch | 42 +++++++++++++++++++ .../ib700wdt.c-fix-buffer_underflow-bug.patch | 37 ++++++++++++++++ review-2.6.27/series | 2 + 3 files changed, 81 insertions(+) create mode 100644 review-2.6.27/applicom-fix-an-unchecked-user-ioctl-range-and-an-error-return.patch create mode 100644 review-2.6.27/ib700wdt.c-fix-buffer_underflow-bug.patch diff --git a/review-2.6.27/applicom-fix-an-unchecked-user-ioctl-range-and-an-error-return.patch b/review-2.6.27/applicom-fix-an-unchecked-user-ioctl-range-and-an-error-return.patch new file mode 100644 index 00000000000..0f848b22166 --- /dev/null +++ b/review-2.6.27/applicom-fix-an-unchecked-user-ioctl-range-and-an-error-return.patch @@ -0,0 +1,42 @@ +From a7be18d436f0c7007794965e5af29fa1ffff1e05 Mon Sep 17 00:00:00 2001 +From: Alan Cox +Date: Mon, 13 Oct 2008 10:45:17 +0100 +Subject: applicom: Fix an unchecked user ioctl range and an error return + +From: Alan Cox + +commit a7be18d436f0c7007794965e5af29fa1ffff1e05 upstream. + +Closes bug #11408 by checking the card index range for command 0 +Fixes the ioctl to return ENOTTY which is correct for unknown ioctls + +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/applicom.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/char/applicom.c ++++ b/drivers/char/applicom.c +@@ -712,8 +712,7 @@ static int ac_ioctl(struct inode *inode, + + IndexCard = adgl->num_card-1; + +- if(cmd != 0 && cmd != 6 && +- ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) { ++ if(cmd != 6 && ((IndexCard >= MAX_BOARD) || !apbs[IndexCard].RamIO)) { + static int warncount = 10; + if (warncount) { + printk( KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n",(int)IndexCard+1); +@@ -832,8 +831,7 @@ static int ac_ioctl(struct inode *inode, + } + break; + default: +- printk(KERN_INFO "APPLICOM driver ioctl, unknown function code %d\n",cmd) ; +- ret = -EINVAL; ++ ret = -ENOTTY; + break; + } + Dummy = readb(apbs[IndexCard].RamIO + VERS); diff --git a/review-2.6.27/ib700wdt.c-fix-buffer_underflow-bug.patch b/review-2.6.27/ib700wdt.c-fix-buffer_underflow-bug.patch new file mode 100644 index 00000000000..004a343d372 --- /dev/null +++ b/review-2.6.27/ib700wdt.c-fix-buffer_underflow-bug.patch @@ -0,0 +1,37 @@ +From 7c2500f17d65092d93345f3996cf82ebca17e9ff Mon Sep 17 00:00:00 2001 +From: Wim Van Sebroeck +Date: Wed, 15 Oct 2008 08:53:06 +0000 +Subject: [WATCHDOG] ib700wdt.c - fix buffer_underflow bug + +From: Wim Van Sebroeck + +commit 7c2500f17d65092d93345f3996cf82ebca17e9ff upstream. + +This fixes Bug 11399: +if ibwdt_set_heartbeat(int t) is called with value 30 then +the check "if ((t < 0) || (t > 30))" in ibwdt_set_heartbeat +is not going to fail because t == 30, but in the loop, the +check wd_times[i] > t is never going to be true because +none of the wd_times are greater than the value of t (i.e. 30). +So we are exiting the loop with i == -1 and therefore setting +wd_margin to -1 which is wrong. + +Reported-by: Zvonimir Rakamaric +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/ib700wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/watchdog/ib700wdt.c ++++ b/drivers/watchdog/ib700wdt.c +@@ -154,7 +154,7 @@ static int ibwdt_set_heartbeat(int t) + return -EINVAL; + + for (i = 0x0F; i > -1; i--) +- if (wd_times[i] > t) ++ if (wd_times[i] >= t) + break; + wd_margin = i; + return 0; diff --git a/review-2.6.27/series b/review-2.6.27/series index c48a8c8f595..7ce4b7da1cd 100644 --- a/review-2.6.27/series +++ b/review-2.6.27/series @@ -82,3 +82,5 @@ cifs-fix-a-regression-in-cifs-umount-codepath.patch pnp-make-the-resource-type-an-unsigned-long.patch powerpc-use-cpu_thread_in_core-in-smp_init-for-of_spin_map.patch xfs-fix-hang-after-disallowed-rename-across-directory-quota-domains.patch +applicom-fix-an-unchecked-user-ioctl-range-and-an-error-return.patch +ib700wdt.c-fix-buffer_underflow-bug.patch -- 2.47.3