[PATCH] fealnx #6: Francois' fixes for low memory handling; remove free_one_rx_descriptor (not used anymore)

this can inadvertently (re)enable tx and/or rx.

As Arjan points out, the patch does exactly the opposite
of what it was claimed to do.

Andrea: tssk tssk.

Cset exclude: akpm@osdl.org[torvalds]|ChangeSet|20040421144431|15930

From: Yury Umanets <torque@ukrpost.net>

I have found small inconsistency in loop_set_fd().  It checks if
->sendfile() is implemented for passed block device file.  But in fact,
loop back device driver never calls it.  It uses ->sendfile() from backing
store file.

From: William Lee Irwin III <wli@holomorphy.com>

i386 does hardware interpretation of pagetables, so pte_clear() can't be
used on present ptes, as it sets the upper half of the hugepte prior to
setting the lower half (which includes the valid bit).  i.e.  there is a
window where having a hugepage mapped at 56GB and doing pte_clear() in
unmap_hugepage_range() allows other threads of the process to see a
hugepage at 0 in place of the original hugepage at 56GB.

This patch corrects the situation by using ptep_get_and_clear(), which
clears the lower word of the pte prior to clearing the upper word.

There is another nasty where huge_page_release() needs to wait for TLB
flushes before returning the hugepages to the free pool, analogous to the
issue tlb_remove_page() and tlb_flush_mm() repair.

From: Andrea Arcangeli <andrea@suse.de>

Arrange for ioctl(FBIOPUTCMAP) to do copy_to_user() rather than memcpy.

From: Andrea Arcangeli <andrea@suse.de>

Correctly range-check an incoming-from-userspace argument.  Found by the
Stanford checker.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch removes a hardcoded policy assumption from the get_user_sids logic
in the SELinux module that was preventing it from returning contexts that had
the same type as the caller even if the policy allowed such a transition.  The
assumption is not valid for all policies, and can be handled via policy
configuration and userspace rather than hardcoding it in the module logic.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch adds a kernel configuration option that enables writing to a new
selinuxfs node 'disable' that allows SELinux to be disabled at runtime prior
to initial policy load.  SELinux will then remain disabled until next boot.
This option is similar to the selinux=0 boot parameter, but is to support
runtime disabling of SELinux, e.g.  from /sbin/init, for portability across
platforms where boot parameters are difficult to employ (based on feedback by
Jeremy Katz).

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch changes the behavior of security_context_to_sid in the no-policy
case so that it simply accepts all contexts and maps them to the kernel SID
rather than rejecting anything other than an initial SID.  The change avoids
error conditions when using SELinux in permissive/no-policy mode, so that any
file contexts left on disk from prior use of SELinux with a policy will not
cause an error when they are looked up and userspace attempts to set contexts
can succeed.

From: Marcel Holtmann <marcel@holtmann.org>

This patch adds the needed compat ioctl's for the CAPI on 64bit platforms.

From: Christoph Hellwig <hch@lst.de>

This patch makes the device mapper use the new freeze_bdev/thaw_bdev
interface.  Extracted from Chris Mason's patch.

From: Christoph Hellwig <hch@lst.de>

Remove all the code now in the VFS, make XFS's freeze ioctls use the new
infastructure and reorganize some code.

This code needs some work so the source files shared with 2.4 aren't
exposed to the new VFS interfaces directly.  You'll get an update once this
has been discussed with the other XFS developers and is implemented.  Note
that the current patch works fine and I wouldn't complain if it gets into
Linus' tree as-is.

From: Chris Mason <mason@suse.com>

reiserfs_write_super_lockfs() is supposed to wait for the transaction to
commit.

From: Christoph Hellwig <hch@lst.de>

These are the generic lockfs bits.  Basically it takes the XFS freezing
statemachine into the VFS.  It's all behind the kernel-doc documented
freeze_bdev and thaw_bdev interfaces.

Based on an older patch from Chris Mason.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

We've had trouble with this driver, it appears to work but the hardware
never does the final reboot.  I have yet to come across someone with a
board which works and don't have personal access to one.  So how about
scrapping the whole thing.

populate_rootfs() is called rather early - before we've called init_idle().

But populate_rootfs() does file I/O, which involves calls to cond_resched(),
and downing of semaphores, etc.  If it scheules, the scheduler emits
scheduling-while-atomic warnings and sometimes oopses.

So run populate_rootfs() later, after the scheduler is all set up.

From: Marc-Christian Petersen <m.c.p@kernel.linux-systeme.com>

Solar Designer discovered an information leak in the ext3 code of Linux.
In a worst case an attacker could read sensitive data such as cryptographic
keys which would otherwise never hit disk media.  Theodore Ts'o developed a
correction for this.

From: Andy Lutomirski <luto@myrealbox.com>

Fixes from me, Olaf Dietsche <olaf+list.linux-kernel@olafdietsche.de>

In fs/exec.c, compute_creds does:

	task_lock(current);
	if (bprm->e_uid != current->uid || bprm->e_gid != current->gid) {
                 current->mm->dumpable = 0;

		if (must_not_trace_exec(current)
		    || atomic_read(&current->fs->count) > 1
		    || atomic_read(&current->files->count) > 1
		    || atomic_read(&current->sighand->count) > 1) {
			if(!capable(CAP_SETUID)) {
				bprm->e_uid = current->uid;
				bprm->e_gid = current->gid;
			}
		}
	}

         current->suid = current->euid = current->fsuid = bprm->e_uid;
         current->sgid = current->egid = current->fsgid = bprm->e_gid;

	task_unlock(current);

	security_bprm_compute_creds(bprm);

I assume the task_lock is to prevent another process (on SMP or preempt)
from ptracing the execing process between the check and the assignment.  If
that's the concern then the fact that the lock is dropped before the call
to security_brpm_compute_creds means that, if security_bprm_compute_creds
does anything interesting, there's a race.

For my (nearly complete) caps patch, I obviously need to fix this.  But I
think it may be exploitable now.  Suppose there are two processes, A (the
malicious code) and B (which uses exec).  B starts out unprivileged (A and
B have, e.g., uid and euid = 500).

1. A ptraces B.

2. B calls exec on some setuid-root program.

3. in cap_bprm_set_security, B sets bprm->cap_permitted to the full
   set.

4. B gets to compute_creds in exec.c, calls task_lock, and does not
   change its uid.

5. B calls task_unlock.

6. A detaches from B (on preempt or SMP).

7. B gets to task_lock in cap_bprm_compute_creds, changes its
   capabilities, and returns from compute_creds into load_elf_binary.

8. load_elf_binary calls create_elf_tables (line 852 in 2.6.5-mm1),
   which calls cap_bprm_secureexec (through LSM), which returns false (!).

9. exec finishes.

The setuid program is now running with uid=euid=500 but full permitted
capabilities.  There are two (or three) ways to effectively get local root
now:

1.  IIRC, linux 2.4 doesn't check capabilities in ptrace, so A could
   just ptrace B again.

2. LD_PRELOAD.

3.  There are probably programs that will misbehave on their own under
   these circumstances.

Is there some reason why this is not doable?

The patch renames bprm_compute_creds to bprm_apply_creds and moves all uid
logic into the hook, where the test and the resulting modification can both
happen under task_lock().

This way, out-of-tree LSMs will fail to compile instead of malfunctioning. 
It should also make life easier for LSMs and will certainly make it easier
for me to finish the cap patch.

From: Trond Myklebust <trond.myklebust@fys.uio.no>

The following patch fixes up a number of bugs in the NFSroot parser
rewrite from patchset
trond.myklebust@fys.uio.no|ChangeSet|20040411182341|00938

It also ensures that NFSroot mount options are consistent with the userland
"mount" program.

One of the stack size optimizations introduced a new static variable in
a function marked with __init.  But the variable is not marked
appropriately and so 1k of data is never freed.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Remove bogus assert in CFQ and remove merge hints.

From: Ralf Baechle <ralf@linux-mips.org>

- more work on resurrecting AMD Alchemy platforms
- cleanup of unnecessary <asm/pgalloc.h> inclusions
- update default config files
- cleanup 32-bit compat ioctl code
- support for Montum Jaguar ATX
- workarounds for early revs of the RM9000
- fixes for RM5000 and RM7000 cache handling
- add support for PMC-Sierra Yosemite eval board
- further cleanup and bugfixes for SGI IP27
- make LASAT and VR41xx build and work in 2.6
- improved SGI IP32 support
- plenty of small fixes

From: Ralf Baechle <ralf@linux-mips.org>

The pending changes to the MIPS doc files, more changes needed...

From: Ralf Baechle <ralf@linux-mips.org>

Limit the DZ driver to MIPS32 as the supported hardware is only present in
R2k/R3k-based systems (unless someone sends Maciej a PMAC-A board for driver
development).

From: Christoph Hellwig <hch@lst.de>

We don't need a copy of COPYING down in fs/hfs.  Roman said he didn't mind,
so..

From: "Pedro Emanuel M. D. Pinto" <pepinto@student.dei.uc.pt>

This currently-unused function is incorrectly implemented.  Fix.

Remove a duplicated case which recently snuck in there.

From: Hugh Dickins <hugh@veritas.com>

Jamie points out that madvise(MADV_DONTNEED) should unmap pages from a
nonlinear area in such a way that the nonlinear offsets are preserved if the
pages do turn out to be needed later after all, instead of reverting them to
linearity: needs to pass down a zap_details block.

(But this still leaves mincore unaware of nonlinear vmas: bigger job.)

From: Chris Mason <mason@suse.com>

reiserfs-delayed-work started using queue_delayed_work, but did not make sure
the timer was finished before it freed the work queue structs during unmount. 
This leads to timer oopsen if you unmount at just the right time.

Ulrich has been working on the glibc code using posix-timers and
stressing it more now than it has before.  He ran into an SMP deadlock
on process exit in the case there are pending queued signals from a
timer.

The deadlock arises because in the path through exit_itimers, the
tasklist_lock is already held (for writing).  When a timer is being
deleted, sigqueue_free will try to take it (for reading) in the case
where that timer has a pending signal queued on somebody's queue.  This
patch avoids the problem by making sure the queues are flushed before
calling exit_itimers, thus ensuring its code path won't try to take
tasklist_lock.