Dan Carpenter 58f09e00ae cciss: fix info leak in cciss_ioctl32_passthru() ...

The arg64 struct has a hole after ->buf_size which isn't cleared.  Or if
any of the calls to copy_from_user() fail then that would cause an
information leak as well.

This was assigned CVE-2013-2147.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Mike Miller <mike.miller@hp.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2013-09-24 17:00:26 -07:00

..

aoe

aoe: do not BUG if memory pressure prevented debugfs file creation

2013-09-11 15:59:28 -07:00

drbd

treewide: Add __GFP_NOWARN to k.alloc calls with v.alloc fallbacks

2013-08-20 13:06:40 +02:00

mtip32xx

Remove GENERIC_HARDIRQ config option

2013-09-13 15:09:52 +02:00

paride

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00

rsxx

rsxx: Adding in debugfs entries.

2013-06-19 13:52:10 +02:00

xen-blkback

block: replace strict_strtoul() with kstrtoul()

2013-09-11 15:56:56 -07:00

amiflop.c

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00

ataflop.c

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00

brd.c

drivers/block/brd.c: fix brd_lookup_page() race

2013-05-24 16:22:52 -07:00

cciss_cmd.h

cciss: use new doorbell-bit-5 reset method

2011-05-06 08:23:55 -06:00

cciss_scsi.c

cciss: switch to ->show_info()

2013-04-09 14:13:19 -04:00

cciss_scsi.h

cciss: add cciss_tape_cmds module paramter

2011-05-06 08:23:59 -06:00

cciss.c

cciss: fix info leak in cciss_ioctl32_passthru()

2013-09-24 17:00:26 -07:00

cciss.h

cciss: Adds simple mode functionality

2011-08-08 11:40:15 +02:00

cpqarray.c

cpqarray: fix info leak in ida_locked_ioctl()

2013-09-24 17:00:26 -07:00

cpqarray.h

…

cryptoloop.c

move linux/loop.h to drivers/block

2013-06-29 12:46:45 +04:00

DAC960.c

procfs: new helper - PDE_DATA(inode)

2013-04-09 14:13:32 -04:00

DAC960.h

Fix DAC960 driver on machines which don't support 64-bit DMA

2007-09-11 17:21:19 -07:00

floppy.c

Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block

2013-05-08 10:13:35 -07:00

hd.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

ida_cmd.h

…

ida_ioctl.h

…

Kconfig

rsxx: Changing the adapter name to the official name.

2013-06-19 13:52:09 +02:00

loop.c

move linux/loop.h to drivers/block

2013-06-29 12:46:45 +04:00

loop.h

move linux/loop.h to drivers/block

2013-06-29 12:46:45 +04:00

Makefile

NVMe: Add nvme-scsi.c

2013-03-28 14:50:49 -04:00

mg_disk.c

drivers/block/mg_disk.c: make mg_times_out() static

2013-09-11 15:56:59 -07:00

nbd.c

nbd: correct disconnect behavior

2013-07-03 16:08:05 -07:00

nvme-core.c

NVMe: Merge issue on character device bring-up

2013-09-06 16:26:58 -04:00

nvme-scsi.c

NVMe: Use kzalloc instead of kmalloc+memset

2013-06-19 13:24:27 -04:00

osdblk.c

block: replace strict_strtoul() with kstrtoul()

2013-09-11 15:56:56 -07:00

pktcdvd.c

pktcdvd: fix defective misuses of pkt_<level>

2013-09-11 15:59:34 -07:00

ps3disk.c

Drivers: block: remove __dev* attributes.

2013-01-03 15:57:15 -08:00

ps3vram.c

procfs: new helper - PDE_DATA(inode)

2013-04-09 14:13:32 -04:00

rbd_types.h

rbd: get rid of RBD_MAX_SEG_NAME_LEN

2012-12-17 08:37:29 -06:00

rbd.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client

2013-09-19 12:50:37 -05:00

smart1,2.h

fix typos 'comamnd' -> 'command' in comments

2011-02-02 11:31:21 +01:00

sunvdc.c

sunvdc: Fix off-by-one in generic_request().

2013-02-14 11:49:01 -08:00

swim3.c

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00

swim_asm.S

m68k: mac - Add SWIM floppy support

2009-03-26 21:15:27 +01:00

swim.c

drivers/block/swim.c: remove unnecessary platform_set_drvdata()

2013-09-11 15:56:59 -07:00

sx8.c

block, sx8: fix pointer math issue getting fw version

2012-03-03 19:44:39 +01:00

umem.c

Drivers: block: remove __dev* attributes.

2013-01-03 15:57:15 -08:00

umem.h

drivers/block/umem: trim trailing whitespace

2007-10-10 09:25:59 +02:00

virtio_blk.c

virtio_blk: Add missing 'static' qualifiers

2013-05-20 12:09:23 +09:30

xen-blkfront.c

Merge branch 'stable/for-jens-3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen into for-3.11/drivers

2013-06-28 16:01:14 +02:00

xsysace.c

xilinx systemace: Fix sparse warnings

2013-07-10 07:47:12 +02:00

z2ram.c

block_device_operations->release() should return void

2013-05-07 02:16:21 -04:00