1. 11 Feb, 2007 1 commit
    • Jeff Moyer's avatar
      [PATCH] raw: don't allow the creation of a raw device with minor number 0 · 38584c14
      Jeff Moyer authored
      Minor number 0 (under the raw major) is reserved for the rawctl device
      file, which is used to query, set, and unset raw device bindings.  However,
      the ioctl interface does not protect the user from specifying a raw device
      with minor number 0:
      $ sudo ./raw /dev/raw/raw0 /dev/VolGroup00/swap
      /dev/raw/raw0:  bound to major 253, minor 2
      $ ls -l /dev/rawctl
      ls: /dev/rawctl: No such file or directory
      $ ls -l /dev/raw/raw0
      crw------- 1 root root 162, 0 Jan 12 10:51 /dev/raw/raw0
      $ sudo ./raw -qa
      Cannot open master raw device '/dev/rawctl' (No such file or directory)
      As you can see, this prevents any further raw operations from
      succeeding.  The fix (from Steve Fernandez) is quite simple--do not
      allow the allocation of minor number 0.
      Signed-off-by: default avatarJeff Moyer <jmoyer@redhat.com>
      Cc: Steven Fernandez <sfernand@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
  2. 08 Dec, 2006 1 commit
  3. 01 Dec, 2006 1 commit
  4. 01 Oct, 2006 3 commits
  5. 29 Sep, 2006 1 commit
  6. 03 Jul, 2006 1 commit
  7. 26 Jun, 2006 3 commits
  8. 23 Mar, 2006 1 commit
  9. 28 Oct, 2005 1 commit
  10. 20 Jun, 2005 1 commit
  11. 18 May, 2005 1 commit
    • Stephen Tweedie's avatar
      [PATCH] Fix filp being passed through raw ioctl handler · e72022e1
      Stephen Tweedie authored
      Don't pass meaningless file handles to block device ioctls.
      The recent raw IO ioctl-passthrough fix started passing the raw file
      handle into the block device ioctl handler.  That's unlikely to be
      useful, as the file handle is actually open on a character-mode raw
      device, not a block device, so dereferencing it is not going to yield
      useful results to a block device ioctl handler.
      Previously we just passed NULL; also not a value that can usefully
      be dereferenced, but at least if it does happen, we'll oops instead of
      silently pretending that the file is a block device, so NULL is the more
      defensive option here.  This patch reverts to that behaviour.
      Noticed by Al Viro.
      Signed-off-by: default avatarStephen Tweedie <sct@redhat.com>
      Acked-by: default avatarAl Viro <viro@parcelfarce.linux.theplanet.co.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
  12. 16 May, 2005 1 commit
    • Stephen Tweedie's avatar
      [PATCH] Fix root hole in raw device · 68f66feb
      Stephen Tweedie authored
      [Patch] Fix raw device ioctl pass-through
      Raw character devices are supposed to pass ioctls through to the block
      devices they are bound to.  Unfortunately, they are using the wrong
      function for this: ioctl_by_bdev(), instead of blkdev_ioctl().
      ioctl_by_bdev() performs a set_fs(KERNEL_DS) before calling the ioctl,
      redirecting the user-space buffer access to the kernel address space.
      This is, needless to say, a bad thing.
      This was noticed first on s390, where raw IO was non-functioning.  The
      s390 driver config does not actually allow raw IO to be enabled, which
      was the first part of the problem.  Secondly, the s390 kernel address
      space is distinct from user, causing legal raw ioctls to fail.  I've
      reproduced this on a kernel built with 4G:4G split on x86, which fails
      in the same way (-EFAULT if the address does not exist kernel-side;
      returns success without actually populating the user buffer if it does.)
      The patch below fixes both the config and address-space problems.  It's
      based closely on a patch by Jan Glauber <jang@de.ibm.com>, which has
      been tested on s390 at IBM.  I've tested it on x86 4G:4G (split address
      space) and x86_64 (common address space).
      Kernel-address-space access has been assigned CAN-2005-1264.
      Signed-off-by: default avatarStephen Tweedie <sct@redhat.com>
      Signed-off-by: default avatarDave Jones <davej@redhat.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
  13. 16 Apr, 2005 1 commit
    • Linus Torvalds's avatar
      Linux-2.6.12-rc2 · 1da177e4
      Linus Torvalds authored
      Initial git repository build. I'm not bothering with the full history,
      even though we have it. We can create a separate "historical" git
      archive of that later if we want to, and in the meantime it's about
      3.2GB when imported into git - space that would just make the early
      git days unnecessarily complicated, when we don't have a lot of good
      infrastructure for it.
      Let it rip!