Vasiliy Kulikov 194b3da873 agp: fix arbitrary kernel memory writes ...

pg_start is copied from userspace on AGPIOC_BIND and AGPIOC_UNBIND ioctl
cmds of agp_ioctl() and passed to agpioc_bind_wrap().  As said in the
comment, (pg_start + mem->page_count) may wrap in case of AGPIOC_BIND,
and it is not checked at all in case of AGPIOC_UNBIND.  As a result, user
with sufficient privileges (usually "video" group) may generate either
local DoS or privilege escalation.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

2011-04-21 12:16:55 +10:00

..

agp

agp: fix arbitrary kernel memory writes

2011-04-21 12:16:55 +10:00

hw_random

Merge branches 'defcfg', 'drivers' and 'cyberpro-next' of master.kernel.org:/home/rmk/linux-2.6-arm

2011-03-17 18:48:35 -07:00

ipmi

Fix common misspellings

2011-03-31 11:26:23 -03:00

mwave

Fix common misspellings

2011-03-31 11:26:23 -03:00

pcmcia

Fix common misspellings

2011-03-31 11:26:23 -03:00

tpm

char/tpm: Fix unitialized usage of data buffer

2011-03-29 09:45:34 -07:00

xilinx_hwicap

Fix common misspellings

2011-03-31 11:26:23 -03:00

apm-emulation.c

Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2010-10-24 13:41:39 -07:00

applicom.c

drivers/char/applicom.c: fix information leak to userland

2010-10-27 18:03:14 -07:00

applicom.h

…

bfin-otp.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

briq_panel.c

BKL: remove extraneous #include <smp_lock.h>

2010-11-17 08:59:32 -08:00

bsr.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

ds1302.c

Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl

2010-10-22 10:52:56 -07:00

ds1620.c

Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl

2010-10-22 10:52:56 -07:00

dsp56k.c

Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl

2010-10-22 10:52:56 -07:00

dtlk.c

Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl

2010-10-22 10:52:56 -07:00

efirtc.c

…

generic_nvram.c

drivers: autoconvert trivial BKL users to private mutex

2010-10-05 15:01:04 +02:00

genrtc.c

Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl

2010-10-22 10:52:56 -07:00

hangcheck-timer.c

Input: sysrq - drop tty argument form handle_sysrq()

2010-08-21 00:34:45 -07:00

hpet.c

BKL: remove extraneous #include <smp_lock.h>

2010-11-17 08:59:32 -08:00

i8k.c

Fix gcc 4.5.1 miscompiling drivers/char/i8k.c (again)

2010-11-15 13:27:06 -08:00

Kconfig

drivers/char: add MSM smd_pkt driver

2011-03-23 19:46:38 -07:00

lp.c

Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl

2010-10-22 10:52:56 -07:00

Makefile

drivers/char: add MSM smd_pkt driver

2011-03-23 19:46:38 -07:00

mbcs.c

drivers: autoconvert trivial BKL users to private mutex

2010-10-05 15:01:04 +02:00

mbcs.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

mem.c

drivers/char/mem.c: clean up the code

2011-03-23 19:46:40 -07:00

misc.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

mmtimer.c

posix-timers: Cleanup namespace

2011-02-02 15:28:19 +01:00

msm_smd_pkt.c

drivers/char: add MSM smd_pkt driver

2011-03-23 19:46:38 -07:00

mspec.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

nsc_gpio.c

…

nvram.c

drivers: autoconvert trivial BKL users to private mutex

2010-10-05 15:01:04 +02:00

nwbutton.c

Fix common misspellings

2011-03-31 11:26:23 -03:00

nwbutton.h

…

nwflash.c

drivers: autoconvert trivial BKL users to private mutex

2010-10-05 15:01:04 +02:00

pc8736x_gpio.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

ppdev.c

drivers/char/ppdev.c: fix information leak to userland

2010-10-27 18:03:14 -07:00

ps3flash.c

drop unused dentry argument to ->fsync

2010-05-27 22:05:02 -04:00

ramoops.c

ramoops: fix types, remove typecasts

2011-01-13 08:03:23 -08:00

random.c

Fix common misspellings

2011-03-31 11:26:23 -03:00

raw.c

block: make blkdev_get/put() handle exclusive access

2010-11-13 11:55:17 +01:00

rtc.c

of/device: Replace struct of_device with struct platform_device

2010-08-06 09:25:50 -06:00

scc.h

…

scx200_gpio.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

snsc_event.c

…

snsc.c

Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl

2010-10-22 10:52:56 -07:00

snsc.h

headers: kobject.h redux

2011-01-10 08:51:44 -08:00

sonypi.c

Fix common misspellings

2011-03-31 11:26:23 -03:00

tb0219.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

tlclk.c

Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl

2010-10-22 10:52:56 -07:00

toshiba.c

Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl

2010-10-22 10:52:56 -07:00

ttyprintk.c

tty: now phase out the ioctl file pointer for good

2011-02-17 11:59:56 -08:00

uv_mmtimer.c

BKL: remove extraneous #include <smp_lock.h>

2010-11-17 08:59:32 -08:00

viotape.c

Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl

2010-10-22 10:52:56 -07:00

virtio_console.c

virtio: console: Don't access vqs if device was unplugged

2011-03-06 10:44:13 -08:00