- 13 Nov, 2013 40 commits
-
-
Mathias Krause authored
On 64 bit systems the test for negative message sizes is bogus as the size, which may be positive when evaluated as a long, will get truncated to an int when passed to load_msg(). So a long might very well contain a positive value but when truncated to an int it would become negative. That in combination with a small negative value of msg_ctlmax (which will be promoted to an unsigned type for the comparison against msgsz, making it a big positive value and therefore make it pass the check) will lead to two problems: 1/ The kmalloc() call in alloc_msg() will allocate a too small buffer as the addition of alen is effectively a subtraction. 2/ The copy_from_user() call in load_msg() will first overflow the buffer with userland data and then, when the userland access generates an access violation, the fixup handler copy_user_handle_tail() will try to fill the remainder with zeros -- roughly 4GB. That almost instantly results in a system crash or reset. ,-[ Reproducer (needs to be run as root) ]-- | #include <sys/stat.h> | #include <sys/msg.h> | #include <unistd.h> | #include <fcntl.h> | | int main(void) { | long msg = 1; | int fd; | | fd = open("/proc/sys/kernel/msgmax", O_WRONLY); | write(fd, "-1", 2); | close(fd); | | msgsnd(0, &msg, 0xfffffff0, IPC_NOWAIT); | | return 0; | } '--- Fix the issue by preventing msgsz from getting truncated by consistently using size_t for the message length. This way the size checks in do_msgsnd() could still be passed with a negative value for msg_ctlmax but we would fail on the buffer allocation in that case and error out. Also change the type of m_ts from int to size_t to avoid similar nastiness in other code paths -- it is used in similar constructs, i.e. signed vs. unsigned checks. It should never become negative under normal circumstances, though. Setting msg_ctlmax to a negative value is an odd configuration and should be prevented. As that might break existing userland, it will be handled in a separate commit so it could easily be reverted and reworked without reintroducing the above described bug. Hardening mechanisms for user copy operations would have catched that bug early -- e.g. checking slab object sizes on user copy operations as the usercopy feature of the PaX patch does. Or, for that matter, detect the long vs. int sign change due to truncation, as the size overflow plugin of the very same patch does. [akpm@linux-foundation.org: fix i386 min() warnings] Signed-off-by:Mathias Krause <minipli@googlemail.com> Cc: Pax Team <pageexec@freemail.hu> Cc: Davidlohr Bueso <davidlohr@hp.com> Cc: Brad Spengler <spender@grsecurity.net> Cc: Manfred Spraul <manfred@colorfullife.com> Cc: <stable@vger.kernel.org> [ v2.3.27+ -- yes, that old ;) ] Signed-off-by:
Andrew Morton <akpm@linux-foundation.org> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
-
Xie XiuQi authored
Remove unnecessary work pending test before calling schedule_work(). It has been tested in queue_work_on() already. No functional changed. Signed-off-by:
Xie XiuQi <xiexiuqi@huawei.com> Cc: Tejun Heo <tj@kernel.org> Reviewed-by:
Tejun Heo <tj@kernel.org> Signed-off-by:
-
Ilija Hadzic authored
When devpts is unmounted, there may be a no-longer-used IDR tree hanging off the superblock we are about to kill. This needs to be cleaned up before destroying the SB. The leak is usually not a big deal because unmounting devpts is typically done when shutting down the whole machine. However, shutting down an LXC container instead of a physical machine exposes the problem (the garbage is detectable with kmemleak). Signed-off-by:
Ilija Hadzic <ihadzic@research.bell-labs.com> Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com> Cc: <stable@vger.kernel.org> Signed-off-by:
-
P J P authored
Make menuconfig allows one to choose compression format of an initial ramdisk image. But this choice does not result in duly compressed ramdisk image. Because - $ make install - does not pass on the selected compression choice to the dracut(8) tool, which creates the initramfs file. dracut(8) generates the image with the default compression, ie. gzip(1). This patch exports the selected compression option to a sub-shell environment, so that it could be used by dracut(8) tool to generate appropriately compressed initramfs images. There isn't a straightforward way to pass on options to dracut(8) via positional parameters. Because it is indirectly invoked at the end of a $ make install sequence. # make install -> arch/$arch/boot/Makefile -> arch/$arch/boot/install.sh -> /sbing/installkernel ... -> /sbin/new-kernel-pkg ... -> /sbin/dracut ... Signed-off-by:P J P <ppandit@redhat.com> Signed-off-by:
-
Christian Ruppert authored
Some ARC users say they can boot faster with without kernel compression. This probably depends on things like the FLASH chip they use etc. Until now, kernel compression can only be disabled by removing "select HAVE_<compression>" lines from the architecture Kconfig. So add the Kconfig logic to permit disabling of kernel compression. Signed-off-by:
Christian Ruppert <christian.ruppert@abilis.com> Signed-off-by:
-
Michal Nazarewicz authored
On architectures where long is more then 32 bits, modifying a 32-bit field with set_bit (and other atomic bit operations) may cause bytes following the field to by modified. Because the endianness of the bits within a field is the native endianness of the CPU[1], on big-endian machines, bit number zero is in the last byte of the field. Therefore, `set_bit(0, ptr)' on a 64-bit big-endian machine is roughly equivalent to `((char *)ptr)[7] |= 1', and since w1 driver uses a 32-bit field for holding the flags, this causes bytes beyond the field to be modified. [1] From Documentation/atomic_ops.txt: Native atomic bit operations are defined to operate on objects aligned to the size of an "unsigned long" C data type, and are least of that size. The endianness of the bits within each "unsigned long" are the native endianness of the cpu. Signed-off-by:Michal Nazarewicz <mina86@mina86.com> Cc: Evgeniy Polyakov <zbr@ioremap.net> Cc: Greg KH <greg@kroah.com> Signed-off-by:
-
Jingoo Han authored
Use the wrapper function for retrieving the platform data instead of accessing dev->platform_data directly. This is a cosmetic change to make the code simpler and enhance the readability. Signed-off-by:
Jingoo Han <jg1.han@samsung.com> Acked-by:
Evgeniy Polyakov <zbr@ioremap.net> Cc: Greg KH <greg@kroah.com> Signed-off-by:
-
Roger Tseng authored
In h_msb_read_page() in ms_block.c, flow never reaches case MSB_RP_RECIVE_STATUS_REG. This causes error when MEMSTICK_INT_ERR is encountered and status error bits are going to be examined, but the status will never be copied back. Fix it by transitioning to MSB_RP_RECIVE_STATUS_REG right after MSB_RP_SEND_READ_STATUS_REG. Signed-off-by:
Roger Tseng <rogerable@realtek.com> Acked-by:
Maxim Levitsky <maximlevitsky@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by:
-
Michal Nazarewicz authored
attrs field of attribute_group structure is a pointer to a pointer (as in an array of pointers) rather than pointer to attribute struct (as in an array of structures), so when allocating size of the pointer sholud be used instead of the structure it is pointing to. While at it, also change the call to use kcalloc rather than kzalloc. Signed-off-by:
-
Sachin Kamat authored
The data structure of_match_ptr() protects is always compiled in. Hence of_match_ptr() is not needed. Signed-off-by:
Sachin Kamat <sachin.kamat@linaro.org> Cc: Rodolfo Giometti <giometti@enneenne.com> Signed-off-by:
-
Chen Gang authored
sizeof("Tainted: ") already counts '\0', and after first sprintf(), 's' will start from the current string end (its' value is '\0'). So need not add additional 1 byte for maximized usage of 'buf' in print_tainted(). Signed-off-by:Chen Gang <gang.chen@asianux.com> Signed-off-by:
-
Andy Shevchenko authored
To get name of the file from a pathname let's use kbasename() helper. Signed-off-by:
Andy Shevchenko <andriy.shevchenko@linux.intel.com> Cc: Jingoo Han <jg1.han@samsung.com> Cc: Peter Oberparleiter <peter.oberparleiter@de.ibm.com> Signed-off-by:
-
Andrew Morton authored
pr_warning() is deprecated in favor of pr_warn() Cc: Andy Gospodarek <agospoda@redhat.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Frantisek Hrbata <fhrbata@redhat.com> Cc: Jan Stancek <jstancek@redhat.com> Cc: Kees Cook <keescook@chromium.org> Cc: Peter Oberparleiter <peter.oberparleiter@de.ibm.com> Cc: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by:
-
Andrew Morton authored
kernel/module.c uses a mix of printk(KERN_foo and pr_foo(). Convert it all to pr_foo and make the offered cleanups. Not sure what to do about the printk(KERN_DEFAULT). We don't have a pr_default(). Cc: Rusty Russell <rusty@rustcorp.com.au> Cc: Joe Perches <joe@perches.com> Cc: Frantisek Hrbata <fhrbata@redhat.com> Signed-off-by:
-
Frantisek Hrbata authored
Compile the correct gcov implementation file for the specific gcc version. Signed-off-by:
Frantisek Hrbata <fhrbata@redhat.com> Cc: Jan Stancek <jstancek@redhat.com> Cc: Kees Cook <keescook@chromium.org> Acked-by:
Peter Oberparleiter <peter.oberparleiter@de.ibm.com> Cc: Rusty Russell <rusty@rustcorp.com.au> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Andy Gospodarek <agospoda@redhat.com> Signed-off-by:
-
Frantisek Hrbata authored
The gcov in-memory format changed in gcc 4.7. The biggest change, which requires this special implementation, is that gcov_info no longer contains array of counters for each counter type for all functions and gcov_fn_info is not used for mapping of function's counters to these arrays(offset). Now each gcov_fn_info contans it's counters, which makes things a little bit easier. This is heavily based on the previous gcc_3_4.c implementation and patches provided by Peter Oberparleiter. Specially the buffer gcda implementation for iterator. [akpm@linux-foundation.org: use kmemdup() and kcalloc()] [oberpar@linux.vnet.ibm.com: gcc_4_7.c needs vmalloc.h] Signed-off-by:
-
Frantisek Hrbata authored
Since also the gcov structures(gcov_info, gcov_fn_info, gcov_ctr_info) can change between gcc releases, as shown in gcc 4.7, they cannot be defined in a common header and need to be moved to a specific gcc implemention file. This also requires to make the gcov_info structure opaque for the common code and to introduce simple helpers for accessing data inside gcov_info. Signed-off-by:
-
Chen Gang authored
For registering in add_del_listener(), when kmalloc_node() fails, need return -ENOMEM instead of success code, and cmd_attr_register_cpumask() wants to know about it. After modification, give a simple common test "build -> boot up -> kernel/controllers/cgroup/getdelays by LTP tools". Signed-off-by:
-
Chen Gang authored
kernel/taskstats.c: add nla_nest_cancel() for failure processing between nla_nest_start() and nla_nest_end() When failure occurs between nla_nest_start() and nla_nest_end(), we should call nla_nest_cancel() to clean up related things. Signed-off-by:
-
Chen Gang authored
snprintf() will return the 'ideal' length which may be larger than real buffer length, if we only want to use real length, need use scnprintf() instead of. Signed-off-by:
-
Chen Gang authored
Need to check the return value of proc_put_char(), as was done in __do_proc_doulongvec_minmax(). Signed-off-by:
-
Jan Kara authored
The iterator rbtree_postorder_for_each_entry_safe() relies on pointer underflow behavior when testing for loop termination. In particular it expects that &rb_entry(NULL, type, field)->field is NULL. But the result of this expression is not defined by a C standard and some gcc versions (e.g. 4.3.4) assume the above expression can never be equal to NULL. The net result is an oops because the iteration is not properly terminated. Fix the problem by modifying the iterator to avoid pointer underflows. Signed-off-by:
Jan Kara <jack@suse.cz> Signed-off-by:
Cody P Schafer <cody@linux.vnet.ibm.com> Cc: Michel Lespinasse <walken@google.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Artem Bityutskiy <dedekind1@gmail.com> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Patrick McHardy <kaber@trash.net> Cc: Paul Mundt <lethal@linux-sh.org> Cc: Theodore Ts'o <tytso@mit.edu> Cc: <stable@vger.kernel.org> [3.12.x] Signed-off-by:
-
Kees Cook authored
The get_dumpable() return value is not boolean. Most users of the function actually want to be testing for non-SUID_DUMP_USER(1) rather than SUID_DUMP_DISABLE(0). The SUID_DUMP_ROOT(2) is also considered a protected state. Almost all places did this correctly, excepting the two places fixed in this patch. Wrong logic: if (dumpable == SUID_DUMP_DISABLE) { /* be protective */ } or if (dumpable == 0) { /* be protective */ } or if (!dumpable) { /* be protective */ } Correct logic: if (dumpable != SUID_DUMP_USER) { /* be protective */ } or if (dumpable != 1) { /* be protective */ } Without this patch, if the system had set the sysctl fs/suid_dumpable=2, a user was able to ptrace attach to processes that had dropped privileges to that user. (This may have been partially mitigated if Yama was enabled.) The macros have been moved into the file that declares get/set_dumpable(), which means things like the ia64 code can see them too. CVE-2013-2929 Reported-by:Vasily Kulikov <segoon@openwall.com> Signed-off-by:
Kees Cook <keescook@chromium.org> Cc: "Luck, Tony" <tony.luck@intel.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: <stable@vger.kernel.org> Signed-off-by:
-
Randy Dunlap authored
Under Pseudo filesystems, /proc/kcore support has no help. Fixes a portion of kernel bugzilla #52671: https://bugzilla.kernel.org/show_bug.cgi?id=52671 Thanks for David Howells for the help text. Signed-off-by:
Randy Dunlap <rdunlap@infradead.org> Reported-by: <lailavrazda1979@gmail.com> Signed-off-by:
David Howells <dhowells@redhat.com> Signed-off-by:
-
HATAYAMA Daisuke authored
Clean up proc_reg_get_unmapped_area due to its 80-column limit violation. Signed-off-by:
HATAYAMA Daisuke <d.hatayama@jp.fujitsu.com> Tested-by:
Michael Holzheu <holzheu@linux.vnet.ibm.com> Signed-off-by:
-
Josh Triplett authored
Discussion at Kernel Summit made it clear that the presence or absence of specific Kconfig symbols are not considered ABI, and that no userspace (or bootloader, etc) should rely on them. In addition, kernel-internal symbols are well established as non-ABI, per Documentation/stable_api_nonsense.txt. Document both of these in Documentation/ABI/README, in a new section for notable bits of non-ABI. Signed-off-by:
Josh Triplett <josh@joshtriplett.org> Cc: Rob Landley <rob@landley.net> Cc: Tao Ma <boyu.mt@taobao.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by:
H. Peter Anvin <hpa@zytor.com> Cc: Richard Weinberger <richard.weinberger@gmail.com> Signed-off-by:
-
Johannes Berg authored
When using '!Ffile function' in a docbook template, and the function no longer exists, you get a "no structured comments found" error from the kernel-doc processing script. It's useful to know which functions it was looking for, so print them out in this case. Also do the same for '!Pfile doc-section' The same error also happens when using '!Efile' when some exported functions aren't documented (in the same file.) There's a very large number of such functions though, so don't print the message in this case -- right now it would give ~850 messages. Signed-off-by:
Johannes Berg <johannes.berg@intel.com> Cc: Rob Landley <rob@landley.net> Cc: Randy Dunlap <rdunlap@infradead.org> Signed-off-by:
-
Stefan Raspl authored
Existing tracepoint documentation doesn't mention the popular TRACE_EVENT macro. Since an excellent series of articles on proper usage already exists, respective links are added to the existing documentation. Signed-off-by:
Stefan Raspl <raspl@linux.vnet.ibm.com> Cc: Rob Landley <rob@landley.net> Cc: Jiri Kosina <jkosina@suse.cz> Acked-by:
Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Zoltan Kiss <zoltan.kiss@citrix.com> Cc: Steven Rostedt <rostedt@goodmis.org> Signed-off-by:
-
Luis Ortega Perez de Villar authored
Slots can store up to 13 characters for the file name but one of the examples has one character too many. Signed-off-by:
Luis Ortega Perez de Villar <luiorpe1@upv.es> Acked-by:
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Signed-off-by:
-
Vyacheslav Dubeyko authored
Implement functionality of creation AttributesFile metadata file on HFS+ volume in the case of absence of it. It makes trying to open AttributesFile's B-tree during mount of HFS+ volume. If HFS+ volume hasn't AttributesFile then a pointer on AttributesFile's B-tree keeps as NULL. Thereby, when it is discovered absence of AttributesFile on HFS+ volume in the begin of xattr creation operation then AttributesFile will be created. The creation of AttributesFile will have success in the case of availability (2 * clump) free blocks on HFS+ volume. Otherwise, creation operation is ended with error (-ENOSPC). Signed-off-by:
Vyacheslav Dubeyko <slava@dubeyko.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Christoph Hellwig <hch@infradead.org> Acked-by:
Hin-Tak Leung <htl10@users.sourceforge.net> Signed-off-by:
-
Vyacheslav Dubeyko authored
Implement functionality of AttributesFile's header node initialization. Signed-off-by:
-
Vyacheslav Dubeyko authored
There are situation when HFS+ volume had been created without AttributesFile. Such situation can take place because of using old mkfs.hfs utility or creation HFS+ volume without taking in mind necessity to use xattrs. For example, Mac OS X 10.4 (Tiger) doesn't create AttributesFile during mkfs phase. Also it is a very frequent situation for the case of users that created HFS+ volumes under Linux. As a result, xattrs and POSIX ACLs on HFS+ volume are unavailable for such users. This patchset implements functionality of AttributesFile creation on HFS+ volume in the case of this metadata file absence during operation of xattr creation. This patch: Add functionality of metadata file's clump size calculation. Operation of AttributesFile creation needs in clump size setting. This value will be used when AttributesFile will be extended. This code is adopted from code of newfs_hfs utility of diskdev_cmds packet http://opensource.apple.com/tarballs/diskdev_cmds/. Signed-off-by:
-
Michael Opdenacker authored
This patch removes duplicate defines from fs/hfs/btree.h [akpm@linux-foundation.org: retain the comments] Signed-off-by:
Michael Opdenacker <michael.opdenacker@free-electrons.com> Reviewed-by:
-
Laxman Dewangan authored
The ams AS3722 is a compact system PMU suitable for mobile phones, tablets etc. Add a driver to support accessing the RTC found on the ams AS3722 PMIC using RTC framework. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by:
Laxman Dewangan <ldewangan@nvidia.com> Signed-off-by:
Florian Lobmaier <florian.lobmaier@ams.com> Cc: Mark Brown <broonie@kernel.org> Cc: Linus Walleij <linus.walleij@linaro.org> Signed-off-by:
-
Sangbeom Kim authored
Add real-time clock driver for s5m8767. Signed-off-by:
Sangbeom Kim <sbkim73@samsung.com> Signed-off-by:
-
Manish Badarkhe authored
Currently, driver includes 'pm_runtime.h' which is not used anywhere in code hence remove this unnecessory inclusion. Signed-off-by:
Manish Badarkhe <badarkhe.manish@gmail.com> Signed-off-by:
-
Sangjung Woo authored
In order to be free automatically and make the cleanup paths more simple, use devm_kzalloc() instead of kmalloc(). Signed-off-by:
Sangjung Woo <sangjung.woo@samsung.com> Cc: Joe Perches <joe@perches.com> Cc: Alessandro Zummo <a.zummo@towertech.it> Cc: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by:
-
Sangjung Woo authored
Because dev_*() are used along with pr_debug() function in this code, the debug message is not tidy. This patch converts from pr_debug() to dev_dbg() since dev_*() are encouraged to use in device driver code. Signed-off-by:
-
Michal Simek authored
Driver core clears the driver data to NULL after device_release or on probe failure, so just remove it from here. The relevant driver core change was commit 0998d063 ("device-core: Ensure drvdata = NULL when no driver is bound"). Signed-off-by:
Michal Simek <michal.simek@xilinx.com> Cc: Linus Walleij <linus.walleij@linaro.org> Signed-off-by:
-
Peter Senna Tschudin authored
The variable want_irq is only assigned the values true and false. Change its type to bool. The simplified semantic patch that find this problem is as follows (http://coccinelle.lip6.fr/): @exists@ type T; identifier b; @@ - T + bool b = ...; ... when any b = \(true\|false\) Signed-off-by:
Peter Senna Tschudin <peter.senna@gmail.com> Signed-off-by:
-
