The annotated tag, v3.2-rc6 has been created
at 5292d98194346528607da828962c7e8677c27e15 (tag)
tagging 384703b8e6cd4c8ef08512e596024e028c91c339 (commit)
replaces v3.2-rc5
tagged by Linus Torvalds
on Fri Dec 16 18:36:34 2011 -0800
- Shortlog ------------------------------------------------------------
Linux 3.2-rc6
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)
iQEcBAABAgAGBQJO7AA6AAoJEHm+PkMAQRiGjgkH/1aNwEbvB0EWAr4ZFtqRmWtR
/u4g/EHxUABsHXtJ1zZOf+FhkxPu43tXPAhLmS5+dXBl6iSt4nELCraf84Ts/Y9/
i/PnWMMjRsgPEPo2uA8WlIzMuEyt3aLkC2BVcyunrwPjzUyJcz96xwYahLo6HTa9
A0VQgQtCCcTKCRIMqZTYkUaUYZWjYxDs252+S6BQ8H0bQkT/lHFEp60/efO+cJ6o
CNAivWlg/gsHFGYJp4BtB3XlIzKJuvfl8NxGgC7O33G5/wmezS/MJH+XVwZaqlji
1wUf5R8i5D21hwZRy94oe0pjR6kHw5xcadQlHCDj4NcRV3FQ3uspJFzLO7aDa8o=
=GnQX
-----END PGP SIGNATURE-----
Antonio Quartulli (2):
batman-adv: in case of roaming mark the client with TT_CLIENT_ROAM
batman-adv: delete global entry in case of roaming
-----------------------------------------------------------------------
--
linux integration
The following commit has been merged in the next branch:
commit d22e13c6c380261cf0b13d34e6412a1e393b5197
Author: Sven Eckelmann <sven(a)narfation.org>
Date: Sat Dec 10 15:28:36 2011 +0100
batman-adv: Only write requested number of byte to user buffer
Don't write more than the requested number of bytes of an batman-adv icmp
packet to the userspace buffer. Otherwise unrelated userspace memory might get
overridden by the kernel.
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
diff --git a/icmp_socket.c b/icmp_socket.c
index 3b04fff..d9c1e7b 100644
--- a/icmp_socket.c
+++ b/icmp_socket.c
@@ -136,10 +136,9 @@ static ssize_t bat_socket_read(struct file *file, char __user *buf,
spin_unlock_bh(&socket_client->lock);
- error = copy_to_user(buf, &socket_packet->icmp_packet,
- socket_packet->icmp_len);
+ packet_len = min(count, socket_packet->icmp_len);
+ error = copy_to_user(buf, &socket_packet->icmp_packet, packet_len);
- packet_len = socket_packet->icmp_len;
kfree(socket_packet);
if (error)
--
batman-adv
The following commit has been merged in the next branch:
commit abe653f9ea919aa1c7a00a167b163e147da465a9
Author: Sven Eckelmann <sven(a)narfation.org>
Date: Sat Dec 10 15:28:35 2011 +0100
batman-adv: Directly check read of icmp packet in copy_from_user
The access_ok read check can be directly done in copy_from_user since a failure
of access_ok is handled the same way as an error in __copy_from_user.
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
diff --git a/icmp_socket.c b/icmp_socket.c
index 88ab26f..3b04fff 100644
--- a/icmp_socket.c
+++ b/icmp_socket.c
@@ -187,12 +187,7 @@ static ssize_t bat_socket_write(struct file *file, const char __user *buff,
skb_reserve(skb, sizeof(struct ethhdr));
icmp_packet = (struct icmp_packet_rr *)skb_put(skb, packet_len);
- if (!access_ok(VERIFY_READ, buff, packet_len)) {
- len = -EFAULT;
- goto free_skb;
- }
-
- if (__copy_from_user(icmp_packet, buff, packet_len)) {
+ if (copy_from_user(icmp_packet, buff, packet_len)) {
len = -EFAULT;
goto free_skb;
}
--
batman-adv
The following commit has been merged in the next branch:
commit 201371597326fcd8118be4000954ff9ba8fd0ccd
Author: Paul Kot <pawlkt(a)gmail.com>
Date: Sat Dec 10 15:28:34 2011 +0100
batman-adv: bat_socket_read missing checks
Writing a icmp_packet_rr and then reading icmp_packet can lead to kernel
memory corruption, if __user *buf is just below TASK_SIZE.
Signed-off-by: Paul Kot <pawlkt(a)gmail.com>
[sven(a)narfation.org: made it checkpatch clean]
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
diff --git a/icmp_socket.c b/icmp_socket.c
index defd692..88ab26f 100644
--- a/icmp_socket.c
+++ b/icmp_socket.c
@@ -136,8 +136,8 @@ static ssize_t bat_socket_read(struct file *file, char __user *buf,
spin_unlock_bh(&socket_client->lock);
- error = __copy_to_user(buf, &socket_packet->icmp_packet,
- socket_packet->icmp_len);
+ error = copy_to_user(buf, &socket_packet->icmp_packet,
+ socket_packet->icmp_len);
packet_len = socket_packet->icmp_len;
kfree(socket_packet);
--
batman-adv
The following commit has been merged in the master branch:
commit f6cf3de2e9a4474f27ac00305c2fc6f43f173132
Merge: 5f3776affad426fc2c00be3fb04c1bc1158829c5 517bc3396bf597ed7ca78e760a4dd2cbafc13236
Author: Marek Lindner <lindner_marek(a)yahoo.de>
Date: Sat Dec 10 17:37:43 2011 +0800
Merge branch 'next'
--
batctl