Dan Carpenter 698508f44a cciss: fix info leak in cciss_ioctl32_passthru() ...

commit 58f09e00ae upstream.

The arg64 struct has a hole after ->buf_size which isn't cleared.  Or if
any of the calls to copy_from_user() fail then that would cause an
information leak as well.

This was assigned CVE-2013-2147.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Mike Miller <mike.miller@hp.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2013-10-13 16:08:28 -07:00

..

aoe

Merge branch 'for-3.10/drivers' of git://git.kernel.dk/linux-block

2013-05-08 11:51:05 -07:00

drbd

Merge branch 'for-3.10/drivers' of git://git.kernel.dk/linux-block

2013-05-08 11:51:05 -07:00

mtip32xx

mtip32xx: Correctly handle bio->bi_idx != 0 conditions

2013-05-15 10:09:05 +02:00

paride

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00

rsxx

rsxx: remove unused variable

2013-03-26 14:48:12 -06:00

xen-blkback

xen/blkback: Check device permissions before allowing OP_DISCARD

2013-08-04 16:50:53 +08:00

amiflop.c

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00

ataflop.c

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00

brd.c

drivers/block/brd.c: fix brd_lookup_page() race

2013-05-24 16:22:52 -07:00

cciss_cmd.h

…

cciss_scsi.c

cciss: switch to ->show_info()

2013-04-09 14:13:19 -04:00

cciss_scsi.h

…

cciss.c

cciss: fix info leak in cciss_ioctl32_passthru()

2013-10-13 16:08:28 -07:00

cciss.h

…

cpqarray.c

cpqarray: fix info leak in ida_locked_ioctl()

2013-10-13 16:08:28 -07:00

cpqarray.h

…

cryptoloop.c

…

DAC960.c

procfs: new helper - PDE_DATA(inode)

2013-04-09 14:13:32 -04:00

DAC960.h

…

floppy.c

Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block

2013-05-08 10:13:35 -07:00

hd.c

…

ida_cmd.h

…

ida_ioctl.h

…

Kconfig

block: IBM RamSan 70/80 branding changes.

2013-03-11 19:53:55 +01:00

loop.c

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00

Makefile

NVMe: Add nvme-scsi.c

2013-03-28 14:50:49 -04:00

mg_disk.c

Merge branch 'for-3.10/drivers' of git://git.kernel.dk/linux-block

2013-05-08 11:51:05 -07:00

nbd.c

nbd: correct disconnect behavior

2013-07-21 18:21:29 -07:00

nvme-core.c

NVMe: Add MSI support

2013-05-31 11:45:52 -04:00

nvme-scsi.c

NVMe: Fix a signedness bug in nvme_trans_modesel_get_mp

2013-05-17 09:10:38 -04:00

osdblk.c

…

pktcdvd.c

pktcdvd: silence static checker warning

2013-05-29 15:36:22 +02:00

ps3disk.c

Drivers: block: remove __dev* attributes.

2013-01-03 15:57:15 -08:00

ps3vram.c

procfs: new helper - PDE_DATA(inode)

2013-04-09 14:13:32 -04:00

rbd_types.h

rbd: get rid of RBD_MAX_SEG_NAME_LEN

2012-12-17 08:37:29 -06:00

rbd.c

rbd: fix I/O error propagation for reads

2013-09-26 17:18:29 -07:00

smart1,2.h

…

sunvdc.c

sunvdc: Fix off-by-one in generic_request().

2013-02-14 11:49:01 -08:00

swim3.c

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00

swim_asm.S

…

swim.c

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00

sx8.c

…

umem.c

Drivers: block: remove __dev* attributes.

2013-01-03 15:57:15 -08:00

umem.h

…

virtio_blk.c

virtio_blk: remove nents member.

2013-03-20 15:44:58 +10:30

xen-blkfront.c

xen-blkfront: use a different scatterlist for each request

2013-08-11 18:35:24 -07:00

xsysace.c

drivers/block/xsysace.c: fix id with missing port-number

2013-05-24 16:22:50 -07:00

z2ram.c

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00