kernel/git/stable/linux-stable.git/drivers/cdrom/cdrom.c, branch linux-2.6.32.y

drivers/cdrom/cdrom.c: use kzalloc() for failing hardware

2014-05-19T05:53:15+00:00

commit 542db01579fbb7ea7d1f7bb9ddcef1559df660b2 upstream In drivers/cdrom/cdrom.c mmc_ioctl_cdrom_read_data() allocates a memory area with kmalloc in line 2885. 2885 cgc->buffer = kmalloc(blocksize, GFP_KERNEL); 2886 if (cgc->buffer == NULL) 2887 return -ENOMEM; In line 2908 we can find the copy_to_user function: 2908 if (!ret && copy_to_user(arg, cgc->buffer, blocksize)) The cgc->buffer is never cleaned and initialized before this function. If ret = 0 with the previous basic block, it's possible to display some memory bytes in kernel space from userspace. When we read a block from the disk it normally fills the ->buffer but if the drive is malfunctioning there is a chance that it would only be partially filled. The result is an leak information to userspace. Signed-off-by: Dan Carpenter Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Willy Tarreau

cdrom: use copy_to_user() without the underscores

2012-03-04T17:49:22+00:00

commit 822bfa51ce44f2c63c300fdb76dc99c4d5a5ca9f upstream. "nframes" comes from the user and "nframes * CD_FRAMESIZE_RAW" can wrap on 32 bit systems. That would have been ok if we used the same wrapped value for the copy, but we use a shifted value. We should just use the checked version of copy_to_user() because it's not going to make a difference to the speed. Signed-off-by: Dan Carpenter Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman

block: add and use scsi_blk_cmd_ioctl

2012-01-25T21:53:24+00:00

commit 577ebb374c78314ac4617242f509e2f5e7156649 upstream. Introduce a wrapper around scsi_cmd_ioctl that takes a block device. The function will then be enhanced to detect partition block devices and, in that case, subject the ioctls to whitelisting. Cc: linux-scsi@vger.kernel.org Cc: Jens Axboe Cc: James Bottomley Signed-off-by: Paolo Bonzini Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman [bwh: Backport to 2.6.32 - adjust context] Signed-off-by: Ben Hutchings

sysctl: remove "struct file *" argument of ->proc_handler

2009-09-24T14:21:04+00:00

It's unused. It isn't needed -- read or write flag is already passed and sysctl shouldn't care about the rest. It _was_ used in two places at arch/frv for some reason. Signed-off-by: Alexey Dobriyan Cc: David Howells Cc: "Eric W. Biederman" Cc: Al Viro Cc: Ralf Baechle Cc: Martin Schwidefsky Cc: Ingo Molnar Cc: "David S. Miller" Cc: James Morris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

block: Use accessor functions for queue limits

2009-05-22T21:22:54+00:00

Convert all external users of queue limits to using wrapper functions instead of poking the request queue variables directly. Signed-off-by: Martin K. Petersen Signed-off-by: Jens Axboe

cdrom: reduce stack usage of mmc_ioctl_dvd_read_struct

2008-12-29T07:28:43+00:00

1. kmalloc 192 bytes in dvd_read_bca (which is inlined into dvd_read_struct) 2. Pass struct packet_command to all dvd_read_* functions. Checkstack output: Before: mmc_ioctl_dvd_read_struct: 280 After: mmc_ioctl_dvd_read_struct: 56 Signed-off-by: Marcin Slusarz Cc: Bartlomiej Zolnierkiewicz Cc: Andrew Morton Cc: Jens Axboe Signed-off-by: Jens Axboe

cdrom: split mmc_ioctl to lower stack usage

2008-12-29T07:28:42+00:00

Checkstack output: Before: mmc_ioctl: 584 After: mmc_ioctl_dvd_read_struct: 280 mmc_ioctl_cdrom_subchannel: 152 mmc_ioctl_cdrom_read_data: 120 mmc_ioctl_cdrom_volume: 104 mmc_ioctl_cdrom_read_audio: 104 (mmc_ioctl is inlined into cdrom_ioctl - 104 bytes) Signed-off-by: Marcin Slusarz Cc: Bartlomiej Zolnierkiewicz Cc: Andrew Morton Cc: Jens Axboe Signed-off-by: Jens Axboe

Commands needing to be retried require a complete re-initialization.

2008-12-12T15:04:26+00:00

The test-unit-ready portion of this patch was causing boots to fail on my test machine (as in http://lkml.org/lkml/2008/12/5/161). With this patch in place, the system is booting reliably. Mike Anderson found the same problem in the hp_hw_start_stop code, and I applied the same solution in cdrom_read_cdda_bpc. Signed-off-by: Alan D. Brunelle Cc: Mike Anderson Signed-off-by: Jens Axboe

[PATCH] switch cdrom_{open,release,ioctl} to sane APIs

2008-10-21T11:47:22+00:00

... convert to it in callers Signed-off-by: Al Viro

[PATCH] switch scsi_cmd_ioctl() to passing fmode_t

2008-10-21T11:47:14+00:00

Signed-off-by: Al Viro