kernel/linux.git/drivers/char/raw.c, branch linux-2.6.16.y

raw: don't allow the creation of a raw device with minor number 0

2008-01-20T19:31:32+00:00

Minor number 0 (under the raw major) is reserved for the rawctl device file, which is used to query, set, and unset raw device bindings. However, the ioctl interface does not protect the user from specifying a raw device with minor number 0: $ sudo ./raw /dev/raw/raw0 /dev/VolGroup00/swap /dev/raw/raw0: bound to major 253, minor 2 $ ls -l /dev/rawctl ls: /dev/rawctl: No such file or directory $ ls -l /dev/raw/raw0 crw------- 1 root root 162, 0 Jan 12 10:51 /dev/raw/raw0 $ sudo ./raw -qa Cannot open master raw device '/dev/rawctl' (No such file or directory) As you can see, this prevents any further raw operations from succeeding. The fix (from Steve Fernandez) is quite simple - do not allow the allocation of minor number 0. Signed-off-by: Jeff Moyer Signed-off-by: Adrian Bunk

[PATCH] Driver Core: fix up all callers of class_device_create()

2005-10-28T16:52:52+00:00

The previous patch adding the ability to nest struct class_device changed the paramaters to the call class_device_create(). This patch fixes up all in-kernel users of the function. Signed-off-by: Greg Kroah-Hartman

[PATCH] class: convert drivers/char/* to use the new class api instead of class_simple

2005-06-20T22:15:08+00:00

Signed-off-by: Greg Kroah-Hartman

[PATCH] Fix filp being passed through raw ioctl handler

2005-05-18T16:10:02+00:00

Don't pass meaningless file handles to block device ioctls. The recent raw IO ioctl-passthrough fix started passing the raw file handle into the block device ioctl handler. That's unlikely to be useful, as the file handle is actually open on a character-mode raw device, not a block device, so dereferencing it is not going to yield useful results to a block device ioctl handler. Previously we just passed NULL; also not a value that can usefully be dereferenced, but at least if it does happen, we'll oops instead of silently pretending that the file is a block device, so NULL is the more defensive option here. This patch reverts to that behaviour. Noticed by Al Viro. Signed-off-by: Stephen Tweedie Acked-by: Al Viro Signed-off-by: Linus Torvalds

[PATCH] Fix root hole in raw device

2005-05-17T04:07:21+00:00

[Patch] Fix raw device ioctl pass-through Raw character devices are supposed to pass ioctls through to the block devices they are bound to. Unfortunately, they are using the wrong function for this: ioctl_by_bdev(), instead of blkdev_ioctl(). ioctl_by_bdev() performs a set_fs(KERNEL_DS) before calling the ioctl, redirecting the user-space buffer access to the kernel address space. This is, needless to say, a bad thing. This was noticed first on s390, where raw IO was non-functioning. The s390 driver config does not actually allow raw IO to be enabled, which was the first part of the problem. Secondly, the s390 kernel address space is distinct from user, causing legal raw ioctls to fail. I've reproduced this on a kernel built with 4G:4G split on x86, which fails in the same way (-EFAULT if the address does not exist kernel-side; returns success without actually populating the user buffer if it does.) The patch below fixes both the config and address-space problems. It's based closely on a patch by Jan Glauber , which has been tested on s390 at IBM. I've tested it on x86 4G:4G (split address space) and x86_64 (common address space). Kernel-address-space access has been assigned CAN-2005-1264. Signed-off-by: Stephen Tweedie Signed-off-by: Dave Jones Signed-off-by: Greg Kroah-Hartman

Linux-2.6.12-rc2

2005-04-16T22:20:36+00:00

Initial git repository build. I'm not bothering with the full history, even though we have it. We can create a separate "historical" git archive of that later if we want to, and in the meantime it's about 3.2GB when imported into git - space that would just make the early git days unnecessarily complicated, when we don't have a lot of good infrastructure for it. Let it rip!