Based on a patch from Ernie Petrides
During security research, Red Hat discovered a behavioral flaw in core
dump handling. A local user could create a program that would cause a
core file to be dumped into a directory they would not normally have
permissions to write to. This could lead to a denial of service (disk
consumption), or allow the local user to gain root privileges.
The prctl() system call should never allow to set "dumpable" to the
value 2. Especially not for non-privileged users.
This can be split into three cases:
1) running as root -- then core dumps will already be done as root,
and so prctl(PR_SET_DUMPABLE, 2) is not useful
2) running as non-root w/setuid-to-root -- this is the debatable case
3) running as non-root w/setuid-to-non-root -- then you definitely
do NOT want "dumpable" to get set to 2 because you have the
privilege escalation vulnerability
With case #2, the only potential usefulness is for a program that has
designed to run with higher privilege (than the user invoking it) that
wants to be able to create root-owned root-validated core dumps. This
might be useful as a debugging aid, but would only be safe if the program
had done a chdir() to a safe directory.
There is no benefit to a production setuid-to-root utility, because it
shouldn't be dumping core in the first place. If this is true, then the
same debugging aid could also be accomplished with the "suid_dumpable"
sysctl.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
'devices' is not a good name for a global variable.
Thankfully, it can become static.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Fixed the missing array terminators in AD1988 codec support code.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Fix a occasional deadlock occuring with snd-rtctimer driver,
added irqsave to the lock in tasklet (ALSA bug#952).
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Fixed 'section mismatch' errors in ALSA PCI drivers:
- removed invalid __devinitdata from pci id tables
- fix/remove __devinit of functions called in suspend/resume
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Drop the snd_minor structure's name field that was just a helper for
devfs device deregistration.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
The wavefront driver used __init in some places referenced by __devinit
functions.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Fix the workaround for AD1988A rev2 codec not to apply to AD1988B codec
chips.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Fix the driver string name for Terratec Aureon 7.1 Universe
to fit in 15 letters to avoid the overflow.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
CONFIG_SND_FM801=y, CONFIG_SND_FM801_TEA575X=m resulted in the following
compile error:
<-- snip -->
...
LD vmlinux
sound/built-in.o: In function 'snd_fm801_free':
fm801.c:(.text+0x3c15b): undefined reference to 'snd_tea575x_exit'
sound/built-in.o: In function 'snd_card_fm801_probe':
fm801.c:(.text+0x3cfde): undefined reference to 'snd_tea575x_init'
make: *** [vmlinux] Error 1
<-- snip -->
This patch fixes kernel Bugzilla #6458.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
if one of the first three CS_CHECKS fails, we goto cs_failed:
In this case parse we donr kfree() parse. Since the the last three
CS_CHECKS might also fail, i moved the kfree() below all the CS_CHECKs
and added one in the error path. This fixes coverity bug id #1099
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
This is confirmed to fix a hang due to PCI resource conflicts with
setting up the Cardbus bridge on old laptops with the 440MX chipsets.
Original report by Alessio Sangalli, lspci debugging help by Pekka
Enberg, and trial patch suggested by Daniel Ritz:
"From the docs available i would _guess_ this thing is really similar
to the 82443BX/82371AB combination. at least the SMBus base address
register is hidden at the very same place (32bit at 0x90 in function
3 of the "south" brigde)"
The dang thing is largely undocumented, but the patch was corroborated
by Asit Mallick:
"I am trying to find the register information. 440MX is an integration of
440BX north-bridge without AGP and PIIX4E (82371EB). PIIX4 quirk
should cover the ACPI and SMBus related I/O registers."
and verified to fix the problem by Alessio.
Cc: Daniel Ritz <daniel.ritz-ml@swissonline.ch>
Cc: Asit Mallick <asit.k.mallick@intel.com>
Cc: Pekka Enberg <penberg@cs.helsinki.fi>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Dmitry Torokhov <dtor_core@ameritech.net>
Tested-by: Alessio Sangalli <alesan@manoweb.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
1. Multipath devices for which SetPGID is not supported are not handled well.
Use NOP ccws for path verification (sans path grouping) when SetPGID is not
supported.
2. Check for PGIDs already set with SensePGID on _all_ paths (not just the
first one) and try to find a common one. Moan if no common PGID can be
found (and use NOP verification). If no PGIDs have been set, use the css
global PGID (as before). (Rationale: SetPGID will get a command reject if
the PGID it tries to set does not match the already set PGID.)
3. Immediately before reboot, issue RESET CHANNEL PATH (rcp) on all chpids. This
will remove the old PGIDs. rcp will generate solicited CRWs which can be
savely ignored by the machine check handler (all other actions create
unsolicited CRWs).
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
The module parameters for xpram are not or in a wrong way parsed.
The xpram module uses the module_param_array directive with an int
parameter which causes the kernel to automatically parse the passed
numbers. This will cause errors if arguments are omitted or cause
wrong results if arguments have size qualifiers.
Use module_param_array with charp and parse the arguments later.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
futex_atomic_cmpxchg_inatomic has the same bug as the other
atomic futex operations: the operation needs to be done in the
user address space, not the kernel address space. Add the missing
sacf 256 & sacf 0.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Add a reg_mutex to prevent unregistering a subchannel before it has been
registered. Since 2.6.17, we've seen oopses in kslowcrw when a device is
found to be not operational during sense id when doing initial device
recognition; it is not clear yet why that particular problem was not (yet)
observed with earlier kernels...
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Make sure that raw_local_save_flags and raw_local_irq_restore always get an
unsigned long parameter. raw_irqs_disabled should call raw_local_save_flags
instead of local_save_flags.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
__builtin_trap() has the archictecture defined backend in gcc since gcc 3.3.
To make sure the kernel builds with gcc 3.2 as well, use the old style BUG()
statement if compiled with older gcc versions.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Patch from Pavel Machek
Also warn users about charging in unsuitable temperature.
Signed-off-by: Pavel Machek <pavel@suse.cz>
Acked-by: Richard Purdie <rpurdie@rpsys.net>
Acked-by: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Patch from Pavel Machek
It seems that sharp had charger on by default... This at least turns
it off. Also battery reading now works and is useful.
Signed-off-by: Pavel Machek <pavel@suse.cz>
Acked-by: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Patch from Thomas Gleixner
From: Thomas Gleixner <tglx@linutronix.de>
The genirq conversion of ARM lost a CPU Hotplug helper function.
Restore it.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Patch from Pavel Machek
From: Dirk Opfer <Dirk@Opfer-Online.de>
Fix ucb initialization on collie. Wrong frequency was used and that
led to things not working quite correctly. (I had to actually disable
checks in my tree to get it to boot). It now includes all the
neccessary parts to get it to compile :-).
Signed-off-by: Pavel Machek <pavel@suse.cz>
Acked-by: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
If a configuration was chosen to support both the Versatile
AB and PB boards, the result would write to registers not
available on the PB version of the board. Resolve this by
using machine_is_xxx().
Also, for the CLCD, despite how the code looks, both the AB
and PB access the same location to control the clock rate -
it's just called something different between the two board
versions. Invent our own name for this location and use it
unconditionally.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6:
ACPI: ACPI_DOCK: Initialize the atomic notifier list
ACPI: acpi_os_allocate() fixes
ACPI: SBS: fix initialization, sem2mutex
ACPI: add 'const' to several ACPI file_operations
ACPI: delete some defaults from ACPI Kconfig
ACPI: "Device `[%s]' is not power manageable" make message debug only
ACPI: ACPI_DOCK Kconfig
Revert "Revert "ACPI: dock driver""
ACPI: acpi_os_get_thread_id() returns current
ACPI: ACPICA 20060707
* HEAD:
[DCCP]: Fix sparse warnings.
[TCP]: Remove TCP Compound
[BPQ] lockdep: fix false positive
[IPV4] inetpeer: Get rid of volatile from peer_total
[AX.25]: Get rid of the last volatile.
We can't safely directly access an compat_alloc_user_space() pointer
with the siginfo copy functions. Bounce it through the stack.
Noticed by Al Viro using sparse
[ This was only added post 2.6.17, not in any released kernel ]
Cc: Al Viro <viro@ftp.linux.org.uk>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Add it for P4 model 6 - reported to work and have a similar PMU to
earlier P4s.
Add an p4force=1 module override parameter for future use.
We had a discussion about that earlier - it's a trade off between the
PMU staying compatible or not. I think the force parameter is a
reasonable compromise.
Cc: oprofile-list@lists.sf.net
Cc: Asit Mallick <asit.k.mallick@intel.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
No need for video to be always in
No need for smart battery driver to be always in
Acked-by: Len Brown <len.brown@intel.com>
Cc: linux-acpi@vger.kernel.org
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Currently ia32 binaries behave differently with respect to enabling
READ_IMPLIES_EXEC. On i386 a binary with the exec_stack flag set is
executed with READ_IMPLIES_EXEC enabled as well. The same binary
executes without READ_IMPLIES_EXEC on x86-64.
This causes binaries that work on i386 to fail on x86-64 which goes
somewhat against the whole 32 bit emulation idea.
It has been argued that READ_IMPLIES_EXEC should not be enabled at all
for binaries that have the exec_stack flag. Which is probably a valid
point. However until this is clarified I think x86-64 should behave the
same for ia32 binaries as i386.
The following patch brings x86-64 in sync with i386 for ia32 binaries.
Signed-off-by: Markus Schoder <lists@gammarayburst.de>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
No actual bugs that I can see just a couple of unmarked casts
getting annoying in my debug log files.
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This reverts: f890f92104
The inclusion of TCP Compound needs to be reverted at this time
because it is not 100% certain that this code conforms to the
requirements of Developer's Certificate of Origin 1.1 paragraph (b).
Signed-off-by: David S. Miller <davem@davemloft.net>
Bpqether is encapsulating AX.25 frames into ethernet frames. There is a
virtual bpqether device paired with each ethernet devices, so it's normal
to pass through dev_queue_xmit twice for each frame which triggers the
locking detector.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
The variable peer_total is protected by a lock. The volatile marker
makes no sense. This shaves off 20 bytes on i386.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Marcel Holtmann