1. 20 Dec, 2010 17 commits
  2. 03 Dec, 2010 4 commits
  3. 01 Dec, 2010 3 commits
    • Linus Torvalds's avatar
      Merge branch 'for_linus' of git://github.com/at91linux/linux-2.6-at91 · 22a5b566
      Linus Torvalds authored
      * 'for_linus' of git://github.com/at91linux/linux-2.6-at91:
        at91/board-yl-9200: fix typo in video support
        atmel_spi: fix warning In function 'atmel_spi_dma_map_xfer'
        at91/picotux200: remove commenting usb device and dataflash support
        at91: rename rm9200ek and rm9200dk board file name
        at91rm9200ek: fix warning: 'ek_mmc_data' defined but not used
        at91rm9200dk: fix warning: 'dk_mmc_data' defined but not used
        at91: Convert remaining boards to new-style UART initialization
        at91: merge all at91rm9200 defconfig in one single file
      22a5b566
    • Oleg Nesterov's avatar
      exec: copy-and-paste the fixes into compat_do_execve() paths · 114279be
      Oleg Nesterov authored
      Note: this patch targets 2.6.37 and tries to be as simple as possible.
      That is why it adds more copy-and-paste horror into fs/compat.c and
      uglifies fs/exec.c, this will be cleanuped later.
      
      compat_copy_strings() plays with bprm->vma/mm directly and thus has
      two problems: it lacks the RLIMIT_STACK check and argv/envp memory
      is not visible to oom killer.
      
      Export acct_arg_size() and get_arg_page(), change compat_copy_strings()
      to use get_arg_page(), change compat_do_execve() to do acct_arg_size(0)
      as do_execve() does.
      
      Add the fatal_signal_pending/cond_resched checks into compat_count() and
      compat_copy_strings(), this matches the code in fs/exec.c and certainly
      makes sense.
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
      Cc: stable@kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      114279be
    • Oleg Nesterov's avatar
      exec: make argv/envp memory visible to oom-killer · 3c77f845
      Oleg Nesterov authored
      Brad Spengler published a local memory-allocation DoS that
      evades the OOM-killer (though not the virtual memory RLIMIT):
      http://www.grsecurity.net/~spender/64bit_dos.c
      
      execve()->copy_strings() can allocate a lot of memory, but
      this is not visible to oom-killer, nobody can see the nascent
      bprm->mm and take it into account.
      
      With this patch get_arg_page() increments current's MM_ANONPAGES
      counter every time we allocate the new page for argv/envp. When
      do_execve() succeds or fails, we change this counter back.
      
      Technically this is not 100% correct, we can't know if the new
      page is swapped out and turn MM_ANONPAGES into MM_SWAPENTS, but
      I don't think this really matters and everything becomes correct
      once exec changes ->mm or fails.
      Reported-by: default avatarBrad Spengler <spender@grsecurity.net>
      Reviewed-and-discussed-by: default avatarKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Cc: stable@kernel.org
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      3c77f845
  4. 30 Nov, 2010 11 commits
  5. 29 Nov, 2010 5 commits