kernel/linux.git/drivers/isdn, branch linux-2.6.16.y

I4L: fix isdn_ioctl memory overrun vulnerability (CVE-2007-6151)

2008-01-21T00:14:20+00:00

Fix possible memory overrun issue in the isdn ioctl code. Found by ADLAB Signed-off-by: Karsten Keil Signed-off-by: Adrian Bunk

isdn: avoid copying overly-long strings (CVE-2007-6063)

2008-01-21T00:14:19+00:00

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=9416 Signed-off-by: Karsten Keil Signed-off-by: Adrian Bunk

Call init_timer() for ISDN PPP CCP reset state timer (CVE-2006-5749)

2007-01-04T00:53:41+00:00

The function isdn_ppp_ccp_reset_alloc_state() sets ->timer.function and ->timer.data and later on calls add_timer() with no init_timer() ever done. Noted by Al Viro. Signed-off-by: Marcel Holtmann Signed-off-by: Adrian Bunk

ISDN: fix drivers, by handling errors thrown by ->readstat()

2006-12-17T23:07:43+00:00

This is a particularly ugly on-failure bug, possibly security, since the lack of error handling here is covering up another class of bug: failure to handle copy_to_user() return values. The I4L API function ->readstat() returns an integer, and by looking at several existing driver implementations, it is clear that a negative return value was meant to indicate an error. Given that several drivers already return a negative value indicating an errno-style error, the current code would blindly accept that [negative] value as a valid amount of bytes read. Obvious damage ensues. Correcting ->readstat() handling to properly notice errors fixes the existing code to work correctly on error, and enables future patches to more easily indicate errors during operation. Signed-off-by: Jeff Garzik Signed-off-by: Adrian Bunk

eicon: fix define conflict with ptrace

2006-08-30T15:31:15+00:00

* MODE_MASK is unused in eicon driver. * Conflicts with a ptrace stuff on arm. drivers/isdn/hardware/eicon/divasync.h:259:1: warning: "MODE_MASK" redefined include2/asm/ptrace.h:48:1: warning: this is the location of the previous definition Signed-off-by: Alexey Dobriyan Acked-by: Karsten Keil Acked-by: Armin Schindler Signed-off-by: Adrian Bunk

[PATCH] i4l: fix compatiblity issue with big endian systems

2006-03-07T02:40:43+00:00

This patch fix some compatiblity issues with big endian systems Signed-off-by: Martin Bachem Signed-off-by: Karsten Keil Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] i4l: fix refcounting problem with ttyIx devices

2006-03-07T02:40:43+00:00

If the same ttyIx device was opened by two processes the module was not released and so the usage count went never to zero again. This oneliner fixes the issue. Signed-off-by: Oskar Senft Signed-off-by: Karsten Keil Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] i4l: add new PCI IDs for HFC-S PCI

2006-03-07T02:40:43+00:00

Add new PCI IDs for HFC-S PCI based ISDN TA 'Primux II S0' and 'Primux II S0' from Gerdes AG Signed-off-by: Martin Bachem Signed-off-by: Karsten Keil Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] Fix NULL pointer dereference in isdn_tty_at_cout

2006-02-15T00:09:34+00:00

The changes in the tty related code introduced wrong parenthesis in a if condition in the isdn_tty_at_cout function. This caused access to index -1 in the dev->drv[] array. This patch change it back to the correct condition from the previous versions. Signed-off-by: Karsten Keil Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] mark HISAX_AMD7930 as broken

2006-02-08T06:05:34+00:00

Signed-off-by: Al Viro