1. 10 Feb, 2009 1 commit
  2. 09 Feb, 2009 1 commit
  3. 08 Feb, 2009 11 commits
  4. 07 Feb, 2009 18 commits
  5. 06 Feb, 2009 9 commits
    • David Howells's avatar
      CRED: Fix SUID exec regression · 0bf2f3ae
      David Howells authored
      The patch:
      
      	commit a6f76f23
      	CRED: Make execve() take advantage of copy-on-write credentials
      
      moved the place in which the 'safeness' of a SUID/SGID exec was performed to
      before de_thread() was called.  This means that LSM_UNSAFE_SHARE is now
      calculated incorrectly.  This flag is set if any of the usage counts for
      fs_struct, files_struct and sighand_struct are greater than 1 at the time the
      determination is made.  All of which are true for threads created by the
      pthread library.
      
      However, since we wish to make the security calculation before irrevocably
      damaging the process so that we can return it an error code in the case where
      we decide we want to reject the exec request on this basis, we have to make the
      determination before calling de_thread().
      
      So, instead, we count up the number of threads (CLONE_THREAD) that are sharing
      our fs_struct (CLONE_FS), files_struct (CLONE_FILES) and sighand_structs
      (CLONE_SIGHAND/CLONE_THREAD) with us.  These will be killed by de_thread() and
      so can be discounted by check_unsafe_exec().
      
      We do have to be careful because CLONE_THREAD does not imply FS or FILES.
      
      We _assume_ that there will be no extra references to these structs held by the
      threads we're going to kill.
      
      This can be tested with the attached pair of programs.  Build the two programs
      using the Makefile supplied, and run ./test1 as a non-root user.  If
      successful, you should see something like:
      
      	[dhowells@andromeda tmp]$ ./test1
      	--TEST1--
      	uid=4043, euid=4043 suid=4043
      	exec ./test2
      	--TEST2--
      	uid=4043, euid=0 suid=0
      	SUCCESS - Correct effective user ID
      
      and if unsuccessful, something like:
      
      	[dhowells@andromeda tmp]$ ./test1
      	--TEST1--
      	uid=4043, euid=4043 suid=4043
      	exec ./test2
      	--TEST2--
      	uid=4043, euid=4043 suid=4043
      	ERROR - Incorrect effective user ID!
      
      The non-root user ID you see will depend on the user you run as.
      
      [test1.c]
      #include <stdio.h>
      #include <stdlib.h>
      #include <unistd.h>
      #include <pthread.h>
      
      static void *thread_func(void *arg)
      {
      	while (1) {}
      }
      
      int main(int argc, char **argv)
      {
      	pthread_t tid;
      	uid_t uid, euid, suid;
      
      	printf("--TEST1--\n");
      	getresuid(&uid, &euid, &suid);
      	printf("uid=%d, euid=%d suid=%d\n", uid, euid, suid);
      
      	if (pthread_create(&tid, NULL, thread_func, NULL) < 0) {
      		perror("pthread_create");
      		exit(1);
      	}
      
      	printf("exec ./test2\n");
      	execlp("./test2", "test2", NULL);
      	perror("./test2");
      	_exit(1);
      }
      
      [test2.c]
      #include <stdio.h>
      #include <stdlib.h>
      #include <unistd.h>
      
      int main(int argc, char **argv)
      {
      	uid_t uid, euid, suid;
      
      	getresuid(&uid, &euid, &suid);
      	printf("--TEST2--\n");
      	printf("uid=%d, euid=%d suid=%d\n", uid, euid, suid);
      
      	if (euid != 0) {
      		fprintf(stderr, "ERROR - Incorrect effective user ID!\n");
      		exit(1);
      	}
      	printf("SUCCESS - Correct effective user ID\n");
      	exit(0);
      }
      
      [Makefile]
      CFLAGS = -D_GNU_SOURCE -Wall -Werror -Wunused
      all: test1 test2
      
      test1: test1.c
      	gcc $(CFLAGS) -o test1 test1.c -lpthread
      
      test2: test2.c
      	gcc $(CFLAGS) -o test2 test2.c
      	sudo chown root.root test2
      	sudo chmod +s test2
      Reported-by: default avatarDavid Smith <dsmith@redhat.com>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Acked-by: default avatarDavid Smith <dsmith@redhat.com>
      Signed-off-by: default avatarJames Morris <jmorris@namei.org>
      0bf2f3ae
    • Dave Kleikamp's avatar
      vfs: Don't call attach_nobh_buffers() with an empty list · d4cf109f
      Dave Kleikamp authored
      This is a modification of a patch by Bill Pemberton <wfp5p@virginia.edu>
      
      nobh_write_end() could call attach_nobh_buffers() with head == NULL.
      This would result in a trap when attach_nobh_buffers() attempted to
      access bh->b_this_page.
      
      This can be illustrated by running the writev01 testcase from LTP on jfs.
      
      This error was introduced by commit 5b41e74a "vfs: fix data leak in
      nobh_write_end()".  That patch did not take into account that if
      PageMappedToDisk() is true upon entry to nobh_write_begin(), then no
      buffers will be allocated for the page.  In that case, we won't have to
      worry about a failed write leaving unitialized data in the page.
      
      Of course, head != NULL implies !page_has_buffers(page), so no need to
      test both.
      Signed-off-by: default avatarDave Kleikamp <shaggy@linux.vnet.ibm.com>
      Cc: Bill Pemberton <wfp5p@virginia.edu>
      Cc: Dmitri Monakhov <dmonakhov@openvz.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d4cf109f
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 · 6cec5083
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
        ALSA: hda - Add missing COEF initialization for ALC887
        ALSA: hda - Add missing initialization for ALC272
        sound: usb-audio: handle wMaxPacketSize for FIXED_ENDPOINT devices
        ALSA: hda - Fix misc workqueue issues
        ALSA: hda - Add quirk for FSC Amilo Xi2550
      6cec5083
    • Len Brown's avatar
      ACPI: disable ACPI cleanly when bad RSDP found · 9e3a9d1e
      Len Brown authored
      When ACPI is disabled in the BIOS of this VIA C3 box,
      it invalidates the RSDP, which Linux notices:
      
      ACPI Error (tbxfroot-0218): A valid RSDP was not found [20080926]
      
      Bug Linux neglected to disable ACPI at that stage,
      and later scribbled on smp_found_config:
      
      ACPI: No APIC-table, disabling MPS
      
      But this box doesn't run well in legacy PIC mode,
      it needed IOAPIC mode to perform correctly:
      
      http://lkml.org/lkml/2009/2/5/39
      
      So exit ACPI mode cleanly when we first detect
      that it is hopeless.
      Signed-off-by: default avatarLen Brown <len.brown@intel.com>
      9e3a9d1e
    • Len Brown's avatar
      ACPI: delete CPU_IDLE=n code · 9fdd54f2
      Len Brown authored
      CPU_IDLE=y has been default for ACPI=y since Nov-2007,
      and has shipped in many distributions since then.
      
      Here we delete the CPU_IDLE=n ACPI idle code, since
      nobody should be using it, and we don't want to
      maintain two versions.
      Signed-off-by: default avatarLen Brown <len.brown@intel.com>
      9fdd54f2
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 · 5e3bd4e4
      Linus Torvalds authored
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
        ieee1394: dv1394: move deprecation message from module init to file open
        firewire: core: Remove card from list of cards when enable fails
      5e3bd4e4
    • Uwe Kleine-König's avatar
      Add Sascha Hauer to .mailmap · bcee402e
      Uwe Kleine-König authored
      This fixes the shortlog attribution e.g. for 106757b3Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Acked-by: default avatarSascha Hauer <s.hauer@pengutronix.de>
      Acked-by: default avatarWolfram Sang <w.sang@pengutronix.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      bcee402e
    • Uwe Kleine-König's avatar
      add another mailmap entry for Uwe Kleine-König · 6d7f2caa
      Uwe Kleine-König authored
      I created commit 7971db5a on a machine
      where I forgot to set user.name and user.email before.  The default
      values were not optimal.
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Acked-by: default avatarWolfram Sang <w.sang@pengutronix.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6d7f2caa
    • Li Zefan's avatar
      fork.c: fix NULL pointer dereference when nr_threads == threads-max · 04ec93fe
      Li Zefan authored
      I happened to forked lots of processes, and hit NULL pointer dereference.
      It is because in copy_process() after checking max_threads, 0 is returned
      but not -EAGAIN.
      
      The bug is introduced by "CRED: Detach the credentials from task_struct"
      (commit f1752eec).
      Signed-off-by: default avatarLi Zefan <lizf@cn.fujitsu.com>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Acked-by: default avatarJames Morris <jmorris@namei.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      04ec93fe