Dan Rosenberg 252a52aa4f Fix pktcdvd ioctl dev_minor range check ... The PKT_CTRL_CMD_STATUS device ioctl retrieves a pointer to a pktcdvd_device from the global pkt_devs array. The index into this array is provided directly by the user and is a signed integer, so the comparison to ensure that it falls within the bounds of this array will fail when provided with a negative index. This can be used to read arbitrary kernel memory or cause a crash due to an invalid pointer dereference. This can be exploited by users with permission to open /dev/pktcdvd/control (on many distributions, this is readable by group "cdrom"). Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> [ Rather than add a cast, just make the function take the right type -Linus ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2010-09-27 16:29:06 -07:00
..
aoe	block: push down BKL into .open and .release	2010-08-07 18:25:34 +02:00
drbd	Merge branch 'for-2.6.36' of git://git.kernel.dk/linux-2.6-block	2010-08-10 15:22:42 -07:00
paride	block: push down BKL into .open and .release	2010-08-07 18:25:34 +02:00
DAC960.c	block: push down BKL into .open and .release	2010-08-07 18:25:34 +02:00
DAC960.h	…
Kconfig	paride: fix menu indentation	2010-05-11 09:02:55 +02:00
Makefile	The DRBD driver	2009-10-01 21:17:49 +02:00
amiflop.c	block: push down BKL into .open and .release	2010-08-07 18:25:34 +02:00
ataflop.c	block: push down BKL into .open and .release	2010-08-07 18:25:34 +02:00
brd.c	block: push down BKL into .locked_ioctl	2010-08-07 18:25:00 +02:00
cciss.c	cciss: freeing uninitialized data on error path	2010-09-21 11:49:17 +02:00
cciss.h	cciss: use consistent variable names	2010-08-07 18:52:30 +02:00
cciss_cmd.h	cciss: fix hard reset code.	2010-08-07 18:52:30 +02:00
cciss_scsi.c	cciss: change printks to dev_warn, etc.	2010-08-07 18:52:30 +02:00
cciss_scsi.h	cciss: remove C99-style comments	2010-02-22 13:44:45 +01:00
cpqarray.c	cpqarray: check put_user() result	2010-08-07 18:53:03 +02:00
cpqarray.h	…
cryptoloop.c	…
floppy.c	floppy: make controller const	2010-08-07 18:52:31 +02:00
hd.c	block: remove wrappers for request type/flags	2010-08-07 18:17:56 +02:00
ida_cmd.h	…
ida_ioctl.h	…
loop.c	BLOCK: fix bio.bi_rw handling	2010-08-23 12:33:10 +02:00
mg_disk.c	block: switch s390 tape_block and mg_disk to elevator_change()	2010-08-23 14:02:44 +02:00
nbd.c	Merge branch 'for-2.6.36' of git://git.kernel.dk/linux-2.6-block	2010-08-10 15:22:42 -07:00
osdblk.c	block: remove q->prepare_flush_fn completely	2010-08-07 18:24:15 +02:00
pktcdvd.c	Fix pktcdvd ioctl dev_minor range check	2010-09-27 16:29:06 -07:00
ps3disk.c	block: remove q->prepare_flush_fn completely	2010-08-07 18:24:15 +02:00
ps3vram.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
smart1,2.h	…
sunvdc.c	block: Consolidate phys_segment and hw_segment limits	2010-02-26 13:58:08 +01:00
swim.c	block: push down BKL into .open and .release	2010-08-07 18:25:34 +02:00
swim3.c	block: push down BKL into .open and .release	2010-08-07 18:25:34 +02:00
swim_asm.S	…
sx8.c	block: Consolidate phys_segment and hw_segment limits	2010-02-26 13:58:08 +01:00
ub.c	block: push down BKL into .open and .release	2010-08-07 18:25:34 +02:00
umem.c	block: unify flags for struct bio and struct request	2010-08-07 18:20:39 +02:00
umem.h	…
viodasd.c	block: push down BKL into .open and .release	2010-08-07 18:25:34 +02:00
virtio_blk.c	Merge branch 'for-2.6.36' of git://git.kernel.dk/linux-2.6-block	2010-08-10 15:22:42 -07:00
xd.c	block: push down BKL into .locked_ioctl	2010-08-07 18:25:00 +02:00
xd.h	…
xen-blkfront.c	xen: pvhvm: rename xen_emul_unplug=ignore to =unnnecessary	2010-08-23 11:59:29 +01:00
xsysace.c	of: fix missing headers for of_address_to_resource() in MTD and SysACE drivers	2010-08-17 13:16:47 -06:00
z2ram.c	block: push down BKL into .open and .release	2010-08-07 18:25:34 +02:00