Import 1.0.3

CREDITS

@@ -403,6 +403,15 @@ S: Dragonvagen 1 A 13
 S: FIN-00330 Helsingfors
 S: Finland
 
+N: Kai Petzke
+E: wpp@marie.physik.tu-berlin.de
+D: Driver for Laser Magnetic Storage CD-ROM
+D: Some kernel bug fixes, new swapping routine
+D: Port of the database Postgres
+S: Stresemannstr. 62
+S: 10963 Berlin
+S: Germany
+
 N: Stefan Probst
 E: snprobst@immd4.informatik.uni-erlangen.de
 D: The Linux Support Team Erlangen

Makefile

 VERSION = 1
 PATCHLEVEL = 0
-SUBLEVEL = 2
+SUBLEVEL = 3
 
 all:	Version zImage
 

drivers/char/lp.c

@@ -445,10 +445,10 @@ long lp_init(long kmem_start)
 		for (testvalue = 0 ; testvalue < LP_DELAY ; testvalue++)
 			;
 		testvalue = inb_p(LP_B(offset));
-		if (testvalue != 255) {
+		if (testvalue == LP_DUMMY) {
 			LP_F(offset) |= LP_EXIST;
 			lp_reset(offset);
-			printk("lp_init: lp%d exists (%d), ", offset, testvalue);
+			printk("lp_init: lp%d exists, ", offset);
 			if (LP_IRQ(offset))
 				printk("using IRQ%d\n", LP_IRQ(offset));
 			else

drivers/net/slip.c

@@ -1102,9 +1102,9 @@ slip_ioctl(struct tty_struct *tty, void *file, int cmd, void *arg)
   DPRINTF((DBG_SLIP, "SLIP: ioctl(%d, 0x%X, 0x%X)\n", tty->line, cmd, arg));
   switch(cmd) {
 	case SIOCGIFNAME:
-		err=verify_area(VERIFY_WRITE, arg, 16);
+		err=verify_area(VERIFY_WRITE, arg, strlen(sl->dev->name) + 1);
 		if(err)
-			return -err;
+			return err;
 		memcpy_tofs(arg, sl->dev->name, strlen(sl->dev->name) + 1);
 		return(0);
 	case SIOCGIFENCAP:

drivers/scsi/sg.c

@@ -56,7 +56,7 @@ static int sg_ioctl(struct inode * inode,struct file * file,
  {
   int dev = MINOR(inode->i_rdev);
   if ((dev<0) || (dev>=NR_SG))
-   return -ENXIO
+   return -ENXIO;
   switch(cmd_in)
    {
     case SG_SET_TIMEOUT:

drivers/scsi/sr_ioctl.c

@@ -95,7 +95,7 @@ int sr_ioctl(struct inode * inode, struct file * file, unsigned int cmd, unsigne
         u_char 	sr_cmd[10];
 
 	int dev = inode->i_rdev;
-	int result, target;
+	int result, target, err;
 
 	target = MINOR(dev);
 	if (target >= NR_SR) return -ENXIO;
@@ -192,7 +192,9 @@ int sr_ioctl(struct inode * inode, struct file * file, unsigned int cmd, unsigne
 
 			scsi_free(buffer, 512);
 
-			verify_area (VERIFY_WRITE, (void *) arg, sizeof (struct cdrom_tochdr));
+			err = verify_area (VERIFY_WRITE, (void *) arg, sizeof (struct cdrom_tochdr));
+			if (err)
+				return err;
 			memcpy_tofs ((void *) arg, &tochdr, sizeof (struct cdrom_tochdr));
 			
 			return result;
@@ -230,7 +232,9 @@ int sr_ioctl(struct inode * inode, struct file * file, unsigned int cmd, unsigne
 
 			scsi_free(buffer, 512);
 
-			verify_area (VERIFY_WRITE, (void *) arg, sizeof (struct cdrom_tocentry));
+			err = verify_area (VERIFY_WRITE, (void *) arg, sizeof (struct cdrom_tocentry));
+			if (err)
+				return err;
 			memcpy_tofs ((void *) arg, &tocentry, sizeof (struct cdrom_tocentry));
 
 			return result;
@@ -369,7 +373,9 @@ int sr_ioctl(struct inode * inode, struct file * file, unsigned int cmd, unsigne
 
 			  scsi_free(buffer, 512);
 
-			  verify_area (VERIFY_WRITE, (void *) arg, sizeof (struct cdrom_subchnl));
+			  err = verify_area (VERIFY_WRITE, (void *) arg, sizeof (struct cdrom_subchnl));
+			  if (err)
+				  return err;
 			  memcpy_tofs ((void *) arg, &subchnl, sizeof (struct cdrom_subchnl));
 			  return result;
 			}

fs/ext2/ioctl.c

@@ -17,11 +17,14 @@
 int ext2_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
 		unsigned long arg)
 {
+	int err;
 
 	ext2_debug ("cmd = %u, arg = %lu\n", cmd, arg);
 
 	switch (cmd) {
 	case EXT2_IOC_GETFLAGS:
+		if ((err = verify_area (VERIFY_WRITE, (long *) arg, sizeof(long))))
+			return err;
 		put_fs_long (inode->u.ext2_i.i_flags, (long *) arg);
 		return 0;
 	case EXT2_IOC_SETFLAGS:
@@ -34,6 +37,8 @@ int ext2_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
 		inode->i_dirt = 1;
 		return 0;
 	case EXT2_IOC_GETVERSION:
+		if ((err = verify_area (VERIFY_WRITE, (long *) arg, sizeof(long))))
+			return err;
 		put_fs_long (inode->u.ext2_i.i_version, (long *) arg);
 		return 0;
 	case EXT2_IOC_SETVERSION:

include/linux/mm.h

@@ -73,6 +73,25 @@ extern unsigned long __zero_page(void);
 #define BAD_PAGE __bad_page()
 #define ZERO_PAGE __zero_page()
 
+/* planning stage.. */
+#define P_DIRTY		0x0001
+#define P_LOCKED	0x0002
+#define P_UPTODATE	0x0004
+#define P_RESERVED	0x8000
+
+struct page_info {
+	unsigned short flags;
+	unsigned short count;
+	struct inode * inode;
+	unsigned long offset;
+	struct page_info * next_same_inode;
+	struct page_info * prev_same_inode;
+	struct page_info * next_hash;
+	struct page_info * prev_hash;
+	struct wait_queue *wait;
+};
+/* end of planning stage */
+
 extern volatile short free_page_ptr; /* used by malloc and tcp/ip. */
 
 extern int nr_swap_pages;

ipc/sem.c

@@ -235,7 +235,7 @@ int sys_semctl (int semid, int semnum, int cmd, void *arg)
 		case GETALL:
 			if (!arg || ! (array = (ushort *) get_fs_long((int *) arg)))
 				return -EFAULT;
-			i = verify_area (VERIFY_WRITE, array, nsems* sizeof(short));
+			i = verify_area (VERIFY_WRITE, array, nsems*sizeof(short));
 			if (i)
 				return i;
 		}
@@ -266,7 +266,7 @@ int sys_semctl (int semid, int semnum, int cmd, void *arg)
 	case IPC_STAT:
 		if (!arg || !(buf = (struct semid_ds *) get_fs_long((int *) arg))) 
 			return -EFAULT;
-		if ((i = verify_area (VERIFY_WRITE, arg, sizeof tbuf)))
+		if ((i = verify_area (VERIFY_WRITE, buf, sizeof(*sma))))
 			return i;
 		break;
 	case IPC_SET:

kernel/sched.c

@@ -772,7 +772,7 @@ asmlinkage int sys_nice(long increment)
 
 static void show_task(int nr,struct task_struct * p)
 {
-	int free;
+	unsigned long free;
 	static char * stat_nam[] = { "R", "S", "D", "Z", "T", "W" };
 
 	printk("%-8s %3d ", p->comm, (p == current) ? -nr : nr);

kernel/sys.c

@@ -166,9 +166,14 @@ asmlinkage int sys_vm86(struct vm86_struct * v86)
 {
 	struct vm86_struct info;
 	struct pt_regs * pt_regs = (struct pt_regs *) &v86;
+	int error;
 
 	if (current->saved_kernel_stack)
 		return -EPERM;
+	/* v86 must be readable (now) and writable (for save_v86_state) */
+	error = verify_area(VERIFY_WRITE,v86,sizeof(*v86));
+	if (error)
+		return error;
 	memcpy_fromfs(&info,v86,sizeof(info));
 /*
  * make sure the vm86() system call doesn't try to do anything silly

net/inet/dev.c

@@ -745,6 +745,9 @@ dev_ifconf(char *arg)
   memcpy_fromfs(&ifc, arg, sizeof(struct ifconf));
   len = ifc.ifc_len;
   pos = ifc.ifc_buf;
+  err=verify_area(VERIFY_WRITE, pos, len);
+  if(err)
+	return err;
 
   /* Loop over the interfaces, and write an info block for each. */
   for (dev = dev_base; dev != NULL; dev = dev->next) {

net/inet/ip.c

@@ -1001,6 +1001,8 @@ static struct sk_buff *ip_defrag(struct iphdr *iph, struct sk_buff *skb, struct
  		dev->name, dev->mtu, left, in_ntoa(iph->saddr)));
    	DPRINTF((DBG_IP, " DST=%s\n", in_ntoa(iph->daddr)));
 
+	if (mtu < 8)
+		return;
    	/* Check for any "DF" flag. */
    	if (ntohs(iph->frag_off) & IP_DF) 
    	{

net/inet/sock.c

@@ -428,7 +428,7 @@ destroy_sock(struct sock *sk)
    * structure, otherwise we need to keep it around until
    * everything is gone.
    */
-	  if (sk->rmem_alloc == 0 && sk->wmem_alloc == 0) 
+	  if (sk->dead && sk->rmem_alloc == 0 && sk->wmem_alloc == 0) 
 	  {
 		kfree_s((void *)sk,sizeof(*sk));
 	  } 
@@ -1197,7 +1197,7 @@ inet_accept(struct socket *sock, struct socket *newsock, int flags)
   if (newsock->data) {
   	struct sock * sk = (struct sock *) newsock->data;
   	newsock->data = NULL;
-  	kfree_s(sk, sizeof(struct sock));
+  	destroy_sock(sk);
   }
 
   if (sk1->prot->accept == NULL) return(-EOPNOTSUPP);