<feed xmlns='http://www.w3.org/2005/Atom'>
<title>kernel/linux.git/drivers/cdrom/cdrom.c, branch v3.0.91</title>
<subtitle>Linux kernel stable tree (mirror)</subtitle>
<id>https://git.radix-linux.su/kernel/linux.git/atom?h=v3.0.91</id>
<link rel='self' href='https://git.radix-linux.su/kernel/linux.git/atom?h=v3.0.91'/>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/'/>
<updated>2013-07-13T17:34:43+00:00</updated>
<entry>
<title>drivers/cdrom/cdrom.c: use kzalloc() for failing hardware</title>
<updated>2013-07-13T17:34:43+00:00</updated>
<author>
<name>Jonathan Salwan</name>
<email>jonathan.salwan@gmail.com</email>
</author>
<published>2013-07-03T22:01:13+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=a6ca6dff63f92efa17810ac0a4d33e3b63670482'/>
<id>urn:sha1:a6ca6dff63f92efa17810ac0a4d33e3b63670482</id>
<content type='text'>
commit 542db01579fbb7ea7d1f7bb9ddcef1559df660b2 upstream.

In drivers/cdrom/cdrom.c mmc_ioctl_cdrom_read_data() allocates a memory
area with kmalloc in line 2885.

  2885         cgc-&gt;buffer = kmalloc(blocksize, GFP_KERNEL);
  2886         if (cgc-&gt;buffer == NULL)
  2887                 return -ENOMEM;

In line 2908 we can find the copy_to_user function:

  2908         if (!ret &amp;&amp; copy_to_user(arg, cgc-&gt;buffer, blocksize))

The cgc-&gt;buffer is never cleaned and initialized before this function.
If ret = 0 with the previous basic block, it's possible to display some
memory bytes in kernel space from userspace.

When we read a block from the disk it normally fills the -&gt;buffer but if
the drive is malfunctioning there is a chance that it would only be
partially filled.  The result is an leak information to userspace.

Signed-off-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Cc: Jens Axboe &lt;axboe@kernel.dk&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Cc: Jonathan Salwan &lt;jonathan.salwan@gmail.com&gt;
Cc: Luis Henriques &lt;luis.henriques@canonical.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
</entry>
<entry>
<title>cdrom: use copy_to_user() without the underscores</title>
<updated>2012-03-01T00:34:35+00:00</updated>
<author>
<name>Dan Carpenter</name>
<email>dan.carpenter@oracle.com</email>
</author>
<published>2012-02-06T09:20:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=6b06abace47c8ac0afb6cac21a133b85cd296e50'/>
<id>urn:sha1:6b06abace47c8ac0afb6cac21a133b85cd296e50</id>
<content type='text'>
commit 822bfa51ce44f2c63c300fdb76dc99c4d5a5ca9f upstream.

"nframes" comes from the user and "nframes * CD_FRAMESIZE_RAW" can wrap
on 32 bit systems.  That would have been ok if we used the same wrapped
value for the copy, but we use a shifted value.  We should just use the
checked version of copy_to_user() because it's not going to make a
difference to the speed.

Signed-off-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Signed-off-by: Jens Axboe &lt;axboe@kernel.dk&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
</entry>
<entry>
<title>block: add and use scsi_blk_cmd_ioctl</title>
<updated>2012-01-26T01:24:54+00:00</updated>
<author>
<name>Paolo Bonzini</name>
<email>pbonzini@redhat.com</email>
</author>
<published>2012-01-12T15:01:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=3b8373b85c761b2a12bdaf9fcee4c7a3eefa8459'/>
<id>urn:sha1:3b8373b85c761b2a12bdaf9fcee4c7a3eefa8459</id>
<content type='text'>
commit 577ebb374c78314ac4617242f509e2f5e7156649 upstream.

Introduce a wrapper around scsi_cmd_ioctl that takes a block device.

The function will then be enhanced to detect partition block devices
and, in that case, subject the ioctls to whitelisting.

Cc: linux-scsi@vger.kernel.org
Cc: Jens Axboe &lt;axboe@kernel.dk&gt;
Cc: James Bottomley &lt;JBottomley@parallels.com&gt;
Signed-off-by: Paolo Bonzini &lt;pbonzini@redhat.com&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@suse.de&gt;

</content>
</entry>
<entry>
<title>cdrom: always check_disk_change() on open</title>
<updated>2011-04-29T08:17:25+00:00</updated>
<author>
<name>Tejun Heo</name>
<email>tj@kernel.org</email>
</author>
<published>2011-04-29T08:15:14+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=bf2253a6f00e8fea5b026e471e9f0d0a1b3621f2'/>
<id>urn:sha1:bf2253a6f00e8fea5b026e471e9f0d0a1b3621f2</id>
<content type='text'>
cdrom_open() called check_disk_change() after the rest of open path
succeeded which leads to the following bizarre behavior.

* After media change, if the device opened without O_NONBLOCK,
  open_for_data() naturally fails with -ENOMEDIA and
  check_disk_change() is never called.  The media is known to be gone
  and the open failure makes it obvious to the userland but device
  invalidation never happens.

* But if the device is opened with O_NONBLOCK, all the checks are
  bypassed and cdrom_open() doesn't notice that the media is not there
  and check_disk_change() is called and invalidation happens.

There's nothing to be gained by avoiding calling check_disk_change()
on open failure.  Common cases end up calling check_disk_change()
anyway.  All we get is inconsistent behavior.

Fix it by moving check_disk_change() invocation to the top of
cdrom_open() so that it always gets called regardless of how the rest
of open proceeds.

Stable: 2.6.38

Signed-off-by: Tejun Heo &lt;tj@kernel.org&gt;
Reported-by: Amit Shah &lt;amit.shah@redhat.com&gt;
Tested-by: Amit Shah &lt;amit.shah@redhat.com&gt;
Cc: stable@kernel.org
Signed-off-by: Jens Axboe &lt;jaxboe@fusionio.com&gt;
</content>
</entry>
<entry>
<title>Fix common misspellings</title>
<updated>2011-03-31T14:26:23+00:00</updated>
<author>
<name>Lucas De Marchi</name>
<email>lucas.demarchi@profusion.mobi</email>
</author>
<published>2011-03-31T01:57:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=25985edcedea6396277003854657b5f3cb31a628'/>
<id>urn:sha1:25985edcedea6396277003854657b5f3cb31a628</id>
<content type='text'>
Fixes generated by 'codespell' and manually reviewed.

Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@profusion.mobi&gt;
</content>
</entry>
<entry>
<title>cdrom: support devices that have check_events but not media_changed</title>
<updated>2011-02-09T13:22:37+00:00</updated>
<author>
<name>Simon Arlott</name>
<email>simon@fire.lp0.eu</email>
</author>
<published>2011-02-09T13:21:07+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=b8cf0e0e552ca48e9a00f518aeb4f5e03984022b'/>
<id>urn:sha1:b8cf0e0e552ca48e9a00f518aeb4f5e03984022b</id>
<content type='text'>
Commit 93aae17af1172c40c6f74b7294e93a90c3cfaa5d ("sr: implement
sr_check_events()") replaced the media_changed op with the
check_events op in drivers/scsi/sr.c

All users that check for the CDC_MEDIA_CHANGED capbility try both
the check_events op and the media_changed op, but register_cdrom()
was requiring media_changed.

This patch fixes the capability checking.

The cdrom_select_disc ioctl is also using the two operations, so
they should be required for CDC_SELECT_DISC too.

Signed-off-by: Simon Arlott &lt;simon@fire.lp0.eu&gt;
Cc: Tejun Heo &lt;tj@kernel.org&gt;
Cc: Kay Sievers &lt;kay.sievers@vrfy.org&gt;
Tested-by: Chris Clayton &lt;chris2553@googlemail.com&gt;
Signed-off-by: Jens Axboe &lt;jaxboe@fusionio.com&gt;
</content>
</entry>
<entry>
<title>cdrom: export cdrom_check_events()</title>
<updated>2010-12-16T16:58:50+00:00</updated>
<author>
<name>Jens Axboe</name>
<email>jaxboe@fusionio.com</email>
</author>
<published>2010-12-16T16:58:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=30a7caabbb8e8702b9cf453fee83f773d8b3430d'/>
<id>urn:sha1:30a7caabbb8e8702b9cf453fee83f773d8b3430d</id>
<content type='text'>
It's used by sr, so we need to export it.

Signed-off-by: Jens Axboe &lt;jaxboe@fusionio.com&gt;
</content>
</entry>
<entry>
<title>cdrom: add -&gt;check_events() support</title>
<updated>2010-12-16T16:53:38+00:00</updated>
<author>
<name>Tejun Heo</name>
<email>tj@kernel.org</email>
</author>
<published>2010-12-08T19:57:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=2d9217296bfa6fdc0d3707264076e5296faffdbd'/>
<id>urn:sha1:2d9217296bfa6fdc0d3707264076e5296faffdbd</id>
<content type='text'>
In principle, cdrom just needs to pass through -&gt;check_events() but
CDROM_MEDIA_CHANGED ioctl makes things a bit more complex.  Just as
with -&gt;media_changed() support, cdrom code needs to buffer the events
and serve them to ioctl and vfs as requested.

As the code has to deal with both -&gt;check_events() and
-&gt;media_changed(), and vfs and ioctl event buffering, this patch adds
check_events caching on top of the existing cdi-&gt;mc_flags buffering.

It may be a good idea to deprecate CDROM_MEDIA_CHANGED ioctl and
remove all this mess.

Signed-off-by: Tejun Heo &lt;tj@kernel.org&gt;
Signed-off-by: Jens Axboe &lt;jaxboe@fusionio.com&gt;
</content>
</entry>
<entry>
<title>drivers/cdrom: use pr_&lt;level&gt;</title>
<updated>2010-08-07T16:23:44+00:00</updated>
<author>
<name>Joe Perches</name>
<email>joe@perches.com</email>
</author>
<published>2010-07-01T06:24:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=e597cd09f711b28b8466ebdc2f12e55b44fa81e4'/>
<id>urn:sha1:e597cd09f711b28b8466ebdc2f12e55b44fa81e4</id>
<content type='text'>
- add pr_fmt.

- convert printks to pr_&lt;level&gt;

- add if (0) and printf argument checking to cdinfo

- coalesce consecutive printks to single pr_

- fix a typo "back ground" to "background"

- convert printks without level to pr_info

- remove VIOCD_ prefixes and use pr_fmt/pr_&lt;level&gt;

- add a missing newline to an OS/400 message

Signed-off-by: Joe Perches &lt;joe@perches.com&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;

Folded in tab indentation fix from Andrew.

Signed-off-by: Jens Axboe &lt;jaxboe@fusionio.com&gt;
</content>
</entry>
<entry>
<title>sysctl: Drop &amp; in front of every proc_handler.</title>
<updated>2009-11-18T16:37:40+00:00</updated>
<author>
<name>Eric W. Biederman</name>
<email>ebiederm@xmission.com</email>
</author>
<published>2009-11-16T11:11:48+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=6d4561110a3e9fa742aeec6717248a491dfb1878'/>
<id>urn:sha1:6d4561110a3e9fa742aeec6717248a491dfb1878</id>
<content type='text'>
For consistency drop &amp; in front of every proc_handler.  Explicity
taking the address is unnecessary and it prevents optimizations
like stubbing the proc_handlers to NULL.

Cc: Alexey Dobriyan &lt;adobriyan@gmail.com&gt;
Cc: Ingo Molnar &lt;mingo@elte.hu&gt;
Cc: Joe Perches &lt;joe@perches.com&gt;
Signed-off-by: Eric W. Biederman &lt;ebiederm@xmission.com&gt;
</content>
</entry>
</feed>
