1. 25 Jun, 2013 1 commit
    • Herbert Xu's avatar
      crypto: algboss - Hold ref count on larval · 939e1779
      Herbert Xu authored
      On Thu, Jun 20, 2013 at 10:00:21AM +0200, Daniel Borkmann wrote:
      > After having fixed a NULL pointer dereference in SCTP 1abd165e ("net:
      > sctp: fix NULL pointer dereference in socket destruction"), I ran into
      > the following NULL pointer dereference in the crypto subsystem with
      > the same reproducer, easily hit each time:
      > 
      > BUG: unable to handle kernel NULL pointer dereference at (null)
      > IP: [<ffffffff81070321>] __wake_up_common+0x31/0x90
      > PGD 0
      > Oops: 0000 [#1] SMP
      > Modules linked in: padlock_sha(F-) sha256_generic(F) sctp(F) libcrc32c(F) [..]
      > CPU: 6 PID: 3326 Comm: cryptomgr_probe Tainted: GF            3.10.0-rc5+ #1
      > Hardware name: Dell Inc. PowerEdge T410/0H19HD, BIOS 1.6.3 02/01/2011
      > task: ffff88007b6cf4e0 ti: ffff88007b7cc000 task.ti: ffff88007b7cc000
      > RIP: 0010:[<ffffffff81070321>]  [<ffffffff81070321>] __wake_up_common+0x31/0x90
      > RSP: 0018:ffff88007b7cde08  EFLAGS: 00010082
      > RAX: ffffffffffffffe8 RBX: ffff88003756c130 RCX: 0000000000000000
      > RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff88003756c130
      > RBP: ffff88007b7cde48 R08: 0000000000000000 R09: ffff88012b173200
      > R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000282
      > R13: ffff88003756c138 R14: 0000000000000000 R15: 0000000000000000
      > FS:  0000000000000000(0000) GS:ffff88012fc60000(0000) knlGS:0000000000000000
      > CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      > CR2: 0000000000000000 CR3: 0000000001a0b000 CR4: 00000000000007e0
      > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      > DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      > Stack:
      >  ffff88007b7cde28 0000000300000000 ffff88007b7cde28 ffff88003756c130
      >  0000000000000282 ffff88003756c128 ffffffff81227670 0000000000000000
      >  ffff88007b7cde78 ffffffff810722b7 ffff88007cdcf000 ffffffff81a90540
      > Call Trace:
      >  [<ffffffff81227670>] ? crypto_alloc_pcomp+0x20/0x20
      >  [<ffffffff810722b7>] complete_all+0x47/0x60
      >  [<ffffffff81227708>] cryptomgr_probe+0x98/0xc0
      >  [<ffffffff81227670>] ? crypto_alloc_pcomp+0x20/0x20
      >  [<ffffffff8106760e>] kthread+0xce/0xe0
      >  [<ffffffff81067540>] ? kthread_freezable_should_stop+0x70/0x70
      >  [<ffffffff815450dc>] ret_from_fork+0x7c/0xb0
      >  [<ffffffff81067540>] ? kthread_freezable_should_stop+0x70/0x70
      > Code: 41 56 41 55 41 54 53 48 83 ec 18 66 66 66 66 90 89 75 cc 89 55 c8
      >       4c 8d 6f 08 48 8b 57 08 41 89 cf 4d 89 c6 48 8d 42 e
      > RIP  [<ffffffff81070321>] __wake_up_common+0x31/0x90
      >  RSP <ffff88007b7cde08>
      > CR2: 0000000000000000
      > ---[ end trace b495b19270a4d37e ]---
      > 
      > My assumption is that the following is happening: the minimal SCTP
      > tool runs under ``echo 1 > /proc/sys/net/sctp/auth_enable'', hence
      > it's making use of crypto_alloc_hash() via sctp_auth_init_hmacs().
      > It forks itself, heavily allocates, binds, listens and waits in
      > accept on sctp sockets, and then randomly kills some of them (no
      > need for an actual client in this case to hit this). Then, again,
      > allocating, binding, etc, and then killing child processes.
      > 
      > The problem that might be happening here is that cryptomgr requests
      > the module to probe/load through cryptomgr_schedule_probe(), but
      > before the thread handler cryptomgr_probe() returns, we return from
      > the wait_for_completion_interruptible() function and probably already
      > have cleared up larval, thus we run into a NULL pointer dereference
      > when in cryptomgr_probe() complete_all() is being called.
      > 
      > If we wait with wait_for_completion() instead, this panic will not
      > occur anymore. This is valid, because in case a signal is pending,
      > cryptomgr_probe() returns from probing anyway with properly calling
      > complete_all().
      
      The use of wait_for_completion_interruptible is intentional so that
      we don't lock up the thread if a bug causes us to never wake up.
      
      This bug is caused by the helper thread using the larval without
      holding a reference count on it.  If the helper thread completes
      after the original thread requesting for help has gone away and
      destroyed the larval, then we get the crash above.
      
      So the fix is to hold a reference count on the larval.
      
      Cc: <stable@vger.kernel.org> # 3.6+
      Reported-by: default avatarDaniel Borkmann <dborkman@redhat.com>
      Tested-by: default avatarDaniel Borkmann <dborkman@redhat.com>
      Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      939e1779
  2. 13 Jun, 2013 1 commit
  3. 05 Jun, 2013 3 commits
  4. 28 May, 2013 1 commit
  5. 14 May, 2013 1 commit
  6. 12 May, 2013 2 commits
    • Linus Torvalds's avatar
      Linux 3.10-rc1 · f722406f
      Linus Torvalds authored
      f722406f
    • Linus Torvalds's avatar
      Merge tag 'trace-fixes-v3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 26b840ae
      Linus Torvalds authored
      Pull tracing/kprobes update from Steven Rostedt:
       "The majority of these changes are from Masami Hiramatsu bringing
        kprobes up to par with the latest changes to ftrace (multi buffering
        and the new function probes).
      
        He also discovered and fixed some bugs in doing so.  When pulling in
        his patches, I also found a few minor bugs as well and fixed them.
      
        This also includes a compile fix for some archs that select the ring
        buffer but not tracing.
      
        I based this off of the last patch you took from me that fixed the
        merge conflict error, as that was the commit that had all the changes
        I needed for this set of changes."
      
      * tag 'trace-fixes-v3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing/kprobes: Support soft-mode disabling
        tracing/kprobes: Support ftrace_event_file base multibuffer
        tracing/kprobes: Pass trace_probe directly from dispatcher
        tracing/kprobes: Increment probe hit-count even if it is used by perf
        tracing/kprobes: Use bool for retprobe checker
        ftrace: Fix function probe when more than one probe is added
        ftrace: Fix the output of enabled_functions debug file
        ftrace: Fix locking in register_ftrace_function_probe()
        tracing: Add helper function trace_create_new_event() to remove duplicate code
        tracing: Modify soft-mode only if there's no other referrer
        tracing: Indicate enabled soft-mode in enable file
        tracing/kprobes: Fix to increment return event probe hit-count
        ftrace: Cleanup regex_lock and ftrace_lock around hash updating
        ftrace, kprobes: Fix a deadlock on ftrace_regex_lock
        ftrace: Have ftrace_regex_write() return either read or error
        tracing: Return error if register_ftrace_function_probe() fails for event_enable_func()
        tracing: Don't succeed if event_enable_func did not register anything
        ring-buffer: Select IRQ_WORK
      26b840ae
  7. 11 May, 2013 4 commits
    • Linus Torvalds's avatar
      Merge tag 'stable/for-linus-3.10-rc0-tag-two' of... · 607eeb0b
      Linus Torvalds authored
      Merge tag 'stable/for-linus-3.10-rc0-tag-two' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen
      
      Pull Xen bug-fixes from Konrad Rzeszutek Wilk:
       - More fixes in the vCPU PVHVM hotplug path.
       - Add more documentation.
       - Fix various ARM related issues in the Xen generic drivers.
       - Updates in the xen-pciback driver per Bjorn's updates.
       - Mask the x2APIC feature for PV guests.
      
      * tag 'stable/for-linus-3.10-rc0-tag-two' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
        xen/pci: Used cached MSI-X capability offset
        xen/pci: Use PCI_MSIX_TABLE_BIR, not PCI_MSIX_FLAGS_BIRMASK
        xen: clear IRQ_NOAUTOEN and IRQ_NOREQUEST
        xen: mask x2APIC feature in PV
        xen: SWIOTLB is only used on x86
        xen/spinlock: Fix check from greater than to be also be greater or equal to.
        xen/smp/pvhvm: Don't point per_cpu(xen_vpcu, 33 and larger) to shared_info
        xen/vcpu: Document the xen_vcpu_info and xen_vcpu
        xen/vcpu/pvhvm: Fix vcpu hotplugging hanging.
      607eeb0b
    • Linus Torvalds's avatar
      Merge tag 'scsi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 4c444501
      Linus Torvalds authored
      Pull second SCSI update from James "Jaj B" Bottomley:
       "This is the final round of SCSI patches for the merge window.  It
        consists mostly of driver updates (bnx2fc, ibmfc, fnic, lpfc,
        be2iscsi, pm80xx, qla4x and ipr).
      
        There's also the power management updates that complete the patches in
        Jens' tree, an iscsi refcounting problem fix from the last pull, some
        dif handling in scsi_debug fixes, a few nice code cleanups and an
        error handling busy bug fix."
      
      * tag 'scsi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (92 commits)
        [SCSI] qla2xxx: Update firmware link in Kconfig file.
        [SCSI] iscsi class, qla4xxx: fix sess/conn refcounting when find fns are used
        [SCSI] sas: unify the pointlessly separated enums sas_dev_type and sas_device_type
        [SCSI] pm80xx: thermal, sas controller config and error handling update
        [SCSI] pm80xx: NCQ error handling changes
        [SCSI] pm80xx: WWN Modification for PM8081/88/89 controllers
        [SCSI] pm80xx: Changed module name and debug messages update
        [SCSI] pm80xx: Firmware flash memory free fix, with addition of new memory region for it
        [SCSI] pm80xx: SPC new firmware changes for device id 0x8081 alone
        [SCSI] pm80xx: Added SPCv/ve specific hardware functionalities and relevant changes in common files
        [SCSI] pm80xx: MSI-X implementation for using 64 interrupts
        [SCSI] pm80xx: Updated common functions common for SPC and SPCv/ve
        [SCSI] pm80xx: Multiple inbound/outbound queue configuration
        [SCSI] pm80xx: Added SPCv/ve specific ids, variables and modify for SPC
        [SCSI] lpfc: fix up Kconfig dependencies
        [SCSI] Handle MLQUEUE busy response in scsi_send_eh_cmnd
        [SCSI] sd: change to auto suspend mode
        [SCSI] sd: use REQ_PM in sd's runtime suspend operation
        [SCSI] qla4xxx: Fix iocb_cnt calculation in qla4xxx_send_mbox_iocb()
        [SCSI] ufs: Correct the expected data transfersize
        ...
      4c444501
    • Linus Torvalds's avatar
      Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux · ac4e0109
      Linus Torvalds authored
      Pull idle update from Len Brown:
       "Add support for new Haswell-ULT CPU idle power states"
      
      * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux:
        intel_idle: initial C8, C9, C10 support
        tools/power turbostat: display C8, C9, C10 residency
      ac4e0109
    • Linus Torvalds's avatar
      Merge git://git.infradead.org/users/eparis/audit · c4cc75c3
      Linus Torvalds authored
      Pull audit changes from Eric Paris:
       "Al used to send pull requests every couple of years but he told me to
        just start pushing them to you directly.
      
        Our touching outside of core audit code is pretty straight forward.  A
        couple of interface changes which hit net/.  A simple argument bug
        calling audit functions in namei.c and the removal of some assembly
        branch prediction code on ppc"
      
      * git://git.infradead.org/users/eparis/audit: (31 commits)
        audit: fix message spacing printing auid
        Revert "audit: move kaudit thread start from auditd registration to kaudit init"
        audit: vfs: fix audit_inode call in O_CREAT case of do_last
        audit: Make testing for a valid loginuid explicit.
        audit: fix event coverage of AUDIT_ANOM_LINK
        audit: use spin_lock in audit_receive_msg to process tty logging
        audit: do not needlessly take a lock in tty_audit_exit
        audit: do not needlessly take a spinlock in copy_signal
        audit: add an option to control logging of passwords with pam_tty_audit
        audit: use spin_lock_irqsave/restore in audit tty code
        helper for some session id stuff
        audit: use a consistent audit helper to log lsm information
        audit: push loginuid and sessionid processing down
        audit: stop pushing loginid, uid, sessionid as arguments
        audit: remove the old depricated kernel interface
        audit: make validity checking generic
        audit: allow checking the type of audit message in the user filter
        audit: fix build break when AUDIT_DEBUG == 2
        audit: remove duplicate export of audit_enabled
        Audit: do not print error when LSMs disabled
        ...
      c4cc75c3
  8. 10 May, 2013 27 commits