[PATCH] tty: plug a use-after-free in TIOCGETD ioctl

-by: Milos Vyletel Signed-off-by: Mateusz Guzik --- drivers/tty/tty_io.c | 23 ++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index 892c923..1b10469 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c

Re: CVE-2015-5157 IRET faults during NMIs processing vs 3.10

#x27;ll take some time next week to do this. > Did you get the chance to work on this? Sorry if I somehow missed the patchset. Thanks, -- Mateusz Guzik -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majord...@vger.kernel.org More

[PATCH] sched: fix possible divide by zero in avg_atom calculation

calculations of avg_atom for big nr_switches are now correct. Signed-off-by: Mateusz Guzik Cc: Ingo Molnar Cc: Peter Zijlstra Cc: stable@vger.kernel.org --- kernel/sched/debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index

[PATCH] NFS: populate ->net in mount data when remounting

Otherwise the kernel oopses when remounting with IPv6 server because net is dereferenced in dev_get_by_name. Use net ns of current thread so that dev_get_by_name does not operate on foreign ns. Changing the address is prohibited anyway so this should not affect anything. Signed-off-by: Mateusz

Re: [PATCH 2/2] aio: fix potential leak in aio_run_iocb().

either 0 on success or negative on failure. "if (ret)" replaced by "if (ret < 0)" should indeed set off alarm bells, but turns it turns out to be fine here. > > + if (!ret) > > + ret = rw_verify_area(rw, file, &req->ki_pos, >

Re: [PATCH] mm/swap: fix race on swap_info reuse between swapoff and swapon

if (!p->swap_map[offset]) goto bad_free; so that would need a trivial adjustment. Another nit is that swap_start and swap_next do the following: if (!(si->flags & SWP_USED) || !si->swap_map) continue; Testing for swap_map does not look very nice and regardless of your patch the latter cannot be true if the former is not, thus the check can be simplified to mere !si->swap_map. I'm wondering if it would make sense to dedicate a flag (SWP_ALLOCATED?) to control whether swapon can use give swap_info. That is, it would be tested and set in alloc_swap_info & cleared like you clear SWP_USED now. SWP_USED would be cleared as it is and would be set in _enable_swap_info Then swap_info_get would be left unchanged and swap_* would test for SWP_USED only. -- Mateusz Guzik -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html

Re: [PATCH 3.10] aio: restore locking of ioctx list on removal

On Thu, Dec 05, 2013 at 05:03:47PM -0800, Greg KH wrote: > On Thu, Dec 05, 2013 at 11:09:02AM +0100, Mateusz Guzik wrote: > > Commit 36f5588905c10a8c4568a210d601fe8c3c27e0f0 > > "aio: refcounting cleanup" resulted in ioctx_lock not being held > > during ctx removal,

[PATCH 3.10] aio: restore locking of ioctx list on removal

io: convert the ioctx list to table lookup v3". Fix the problem by restoring appropriate locking. Signed-off-by: Mateusz Guzik Reported-by: Eryu Guan Cc: Jeff Moyer Cc: Kent Overstreet Cc: linux-...@kvack.org Cc: linux-ker...@vger.kernel.org --- fs/aio.c | 10 ++ 1 file changed