aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2012-12-20exec: do not leave bprm->interp on stackKees Cook4-2/+23
If a series of scripts are executed, each triggering module loading via unprintable bytes in the script header, kernel stack contents can leak into the command line. Normally execution of binfmt_script and binfmt_misc happens recursively. However, when modules are enabled, and unprintable bytes exist in the bprm->buf, execution will restart after attempting to load matching binfmt modules. Unfortunately, the logic in binfmt_script and binfmt_misc does not expect to get restarted. They leave bprm->interp pointing to their local stack. This means on restart bprm->interp is left pointing into unused stack memory which can then be copied into the userspace argv areas. After additional study, it seems that both recursion and restart remains the desirable way to handle exec with scripts, misc, and modules. As such, we need to protect the changes to interp. This changes the logic to require allocation for any changes to the bprm->interp. To avoid adding a new kmalloc to every exec, the default value is left as-is. Only when passing through binfmt_script or binfmt_misc does an allocation take place. For a proof of concept, see DoTest.sh from: http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/ Signed-off-by: Kees Cook <[email protected]> Cc: halfdog <[email protected]> Cc: P J P <[email protected]> Cc: Alexander Viro <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2012-12-20drivers/firmware/dmi_scan.c: fetch dmi version from SMBIOS if it existsZhenzhong Duan1-15/+47
The right dmi version is in SMBIOS if it's zero in DMI region This issue was originally found from an oracle bug. One customer noticed system UUID doesn't match between dmidecode & uek2. - HP ProLiant BL460c G6 : # cat /sys/devices/virtual/dmi/id/product_uuid 00000000-0000-4C48-3031-4D5030333531 # dmidecode | grep -i uuid UUID: 00000000-0000-484C-3031-4D5030333531 From SMBIOS 2.6 on, spec use little-endian encoding for UUID other than network byte order. So we need to get dmi version to distinguish. If version is 0.0, the real version is taken from the SMBIOS version. This is part of original kernel comment in code. [[email protected]: checkpatch fixes] Signed-off-by: Zhenzhong Duan <[email protected]> Cc: Feng Jin <[email protected]> Cc: Jean Delvare <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2012-12-20drivers/firmware/dmi_scan.c: check dmi version when get system uuidZhenzhong Duan1-3/+15
As of version 2.6 of the SMBIOS specification, the first 3 fields of the UUID are supposed to be little-endian encoded. Also a minor fix to match variable meaning and mute checkpatch.pl [[email protected]: tweak code comment] Signed-off-by: Zhenzhong Duan <[email protected]> Cc: Feng Jin <[email protected]> Cc: Jean Delvare <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2012-12-20Documentation: kernel-parameters.txt remove capability.disableJosh Boyer1-6/+0
Remove the documentation for capability.disable. The code supporting this parameter was removed with commit 5915eb53861c ("security: remove dummy module") Signed-off-by: Josh Boyer <[email protected]> Acked-by: Serge Hallyn <[email protected]> Cc: Rob Landley <[email protected]> Cc: Miklos Szeredi <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2012-12-20mm: fix calculation of dirtyable memorySonny Rao1-5/+20
The system uses global_dirtyable_memory() to calculate number of dirtyable pages/pages that can be allocated to the page cache. A bug causes an underflow thus making the page count look like a big unsigned number. This in turn confuses the dirty writeback throttling to aggressively write back pages as they become dirty (usually 1 page at a time). This generally only affects systems with highmem because the underflowed count gets subtracted from the global count of dirtyable memory. The problem was introduced with v3.2-4896-gab8fabd Fix is to ensure we don't get an underflowed total of either highmem or global dirtyable memory. Signed-off-by: Sonny Rao <[email protected]> Signed-off-by: Puneet Kumar <[email protected]> Acked-by: Johannes Weiner <[email protected]> Tested-by: Damien Wyart <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2012-12-20compaction: fix build error in CMA && !COMPACTIONMinchan Kim1-6/+20
isolate_freepages_block() and isolate_migratepages_range() are used for CMA as well as compaction so it breaks build for CONFIG_CMA && !CONFIG_COMPACTION. This patch fixes it. [[email protected]: add "do { } while (0)", per Mel] Signed-off-by: Minchan Kim <[email protected]> Cc: Mel Gorman <[email protected]> Cc: Marek Szyprowski <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
2012-12-20vfs: make lremovexattr retry once on ESTALE errorJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: make removexattr retry once on ESTALEJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: make llistxattr retry once on ESTALE errorJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: make listxattr retry once on ESTALE errorJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: make lgetxattr retry once on ESTALEJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: make getxattr retry once on an ESTALE errorJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: allow lsetxattr() to retry once on ESTALE errorsJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: allow setxattr to retry once on ESTALE errorsJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: allow utimensat() calls to retry once on an ESTALE errorJeff Layton1-1/+5
Clearly, we can't handle the NULL filename case, but we can deal with the case where there's a real pathname. Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: fix user_statfs to retry once on ESTALE errorsJeff Layton1-1/+8
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: make fchownat retry once on ESTALE errorsJeff Layton1-0/+5
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: make fchmodat retry once on ESTALE errorsJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: have chroot retry once on ESTALE errorJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: have chdir retry lookup and call once on ESTALE errorJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: have faccessat retry once on an ESTALE errorJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: have do_sys_truncate retry once on an ESTALE errorJeff Layton1-1/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: fix renameat to retry on ESTALE errorsJeff Layton1-3/+12
...as always, rename is the messiest of the bunch. We have to track whether to retry or not via a separate flag since the error handling is already quite complex. Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: make do_unlinkat retry once on ESTALE errorsJeff Layton1-2/+8
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: make do_rmdir retry once on ESTALE errorsJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: add a flags argument to user_path_parentJeff Layton1-6/+10
...so we can pass in LOOKUP_REVAL. For now, nothing does yet. Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: fix linkat to retry once on ESTALE errorsJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: fix symlinkat to retry on ESTALE errorsJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: fix mkdirat to retry once on an ESTALE errorJeff Layton1-1/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: fix mknodat to retry on ESTALE errorsJeff Layton1-2/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: turn is_dir argument to kern_path_create into a lookup_flags argJeff Layton4-9/+20
Where we can pass in LOOKUP_DIRECTORY or LOOKUP_REVAL. Any other flags passed in here are currently ignored. Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: fix readlinkat to retry on ESTALEJeff Layton1-1/+7
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: make fstatat retry on ESTALE errors from getattr callJeff Layton1-2/+6
Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: add a retry_estale helper function to handle retries on ESTALEJeff Layton1-0/+16
This function is expected to be called from path-based syscalls to help them decide whether to try the lookup and call again in the event that they got an -ESTALE return back on an earier try. Currently, we only retry the call once on an ESTALE error, but in the event that we decide that that's not enough in the future, we should be able to change the logic in this helper without too much effort. Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20Merge branch 'fscache' of ↵Al Viro302-3460/+4827
git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into for-linus
2012-12-20vfs: d_obtain_alias() needs to use "/" as default name.NeilBrown1-1/+1
NFS appears to use d_obtain_alias() to create the root dentry rather than d_make_root. This can cause 'prepend_path()' to complain that the root has a weird name if an NFS filesystem is lazily unmounted. e.g. if "/mnt" is an NFS mount then { cd /mnt; umount -l /mnt ; ls -l /proc/self/cwd; } will cause a WARN message like WARNING: at /home/git/linux/fs/dcache.c:2624 prepend_path+0x1d7/0x1e0() ... Root dentry has weird name <> to appear in kernel logs. So change d_obtain_alias() to use "/" rather than "" as the anonymous name. Signed-off-by: NeilBrown <[email protected]> Cc: Trond Myklebust <[email protected]> Cc: Al Viro <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: Remove useless function prototypesAlessio Igor Bogani1-4/+0
Commit 8e22cc88d68ca1a46d7d582938f979eb640ed30f removes the (un)lock_super function definitions but forgets to remove their prototypes. Signed-off-by: Alessio Igor Bogani <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20documentation: drop vmtruncateMarco Stornelli3-18/+1
Removed vmtruncate Signed-off-by: Marco Stornelli <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20mm: drop vmtruncateMarco Stornelli2-24/+0
Removed vmtruncate Signed-off-by: Marco Stornelli <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20vfs: drop vmtruncateMarco Stornelli2-3/+0
Removed vmtruncate Signed-off-by: Marco Stornelli <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20ntfs: drop vmtruncateMarco Stornelli3-5/+23
Removed vmtruncate Signed-off-by: Marco Stornelli <[email protected]> Reviewed-by: Anton Altaparmakov <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20nilfs2: drop vmtruncateMarco Stornelli4-11/+18
Removed vmtruncate Signed-off-by: Marco Stornelli <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20ncpfs: drop vmtruncateMarco Stornelli1-3/+1
Removed vmtruncate Signed-off-by: Marco Stornelli <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20minix: drop vmtruncateMarco Stornelli2-7/+16
Removed vmtruncate Signed-off-by: Marco Stornelli <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20logfs: drop vmtruncateMarco Stornelli1-2/+8
Removed vmtruncate Signed-off-by: Marco Stornelli <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20hfsplus: drop vmtruncateMarco Stornelli1-11/+16
Removed vmtruncate Signed-off-by: Marco Stornelli <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20jfs: drop vmtruncateMarco Stornelli2-8/+18
Removed vmtruncate Signed-off-by: Marco Stornelli <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20hpfs: drop vmtruncateMarco Stornelli3-8/+18
Removed vmtruncate Signed-off-by: Marco Stornelli <[email protected]> Signed-off-by: Al Viro <[email protected]>
2012-12-20FS-Cache: Clear remaining page count on retrieval cancellationDavid Howells3-5/+20
Provide fscache_cancel_op() with a pointer to a function it should invoke under lock if it cancels an operation. Use this to clear the remaining page count upon cancellation of a pending retrieval operation so that fscache_release_retrieval_op() doesn't get an assertion failure (see below). This can happen when a signal occurs, say from CTRL-C being pressed during data retrieval. FS-Cache: Assertion failed 3 == 0 is false ------------[ cut here ]------------ kernel BUG at fs/fscache/page.c:237! invalid opcode: 0000 [#641] SMP Modules linked in: cachefiles(F) nfsv4(F) nfsv3(F) nfsv2(F) nfs(F) fscache(F) auth_rpcgss(F) nfs_acl(F) lockd(F) sunrpc(F) CPU 0 Pid: 6075, comm: slurp-q Tainted: GF D 3.7.0-rc8-fsdevel+ #411 /DG965RY RIP: 0010:[<ffffffffa007f328>] [<ffffffffa007f328>] fscache_release_retrieval_op+0x75/0xff [fscache] RSP: 0000:ffff88001c6d7988 EFLAGS: 00010296 RAX: 000000000000000f RBX: ffff880014cdfe00 RCX: ffffffff6c102000 RDX: ffffffff8102d1ad RSI: ffffffff6c102000 RDI: ffffffff8102d1d6 RBP: ffff88001c6d7998 R08: 0000000000000002 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffe00 R13: ffff88001c6d7ab4 R14: ffff88001a8638a0 R15: ffff88001552b190 FS: 00007f877aaf0700(0000) GS:ffff88003bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 00007fff11378fd2 CR3: 000000001c6c6000 CR4: 00000000000007f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process slurp-q (pid: 6075, threadinfo ffff88001c6d6000, task ffff88001c6c4080) Stack: ffffffffa007ec07 ffff880014cdfe00 ffff88001c6d79c8 ffffffffa007db4d ffffffffa007ec07 ffff880014cdfe00 00000000fffffe00 ffff88001c6d7ab4 ffff88001c6d7a38 ffffffffa008116d 0000000000000000 ffff88001c6c4080 Call Trace: [<ffffffffa007ec07>] ? fscache_cancel_op+0x194/0x1cf [fscache] [<ffffffffa007db4d>] fscache_put_operation+0x135/0x2ed [fscache] [<ffffffffa007ec07>] ? fscache_cancel_op+0x194/0x1cf [fscache] [<ffffffffa008116d>] __fscache_read_or_alloc_pages+0x413/0x4bc [fscache] [<ffffffff810ac8ae>] ? __alloc_pages_nodemask+0x195/0x75c [<ffffffffa00aab0f>] __nfs_readpages_from_fscache+0x86/0x13d [nfs] [<ffffffffa00a5fe0>] nfs_readpages+0x186/0x1bd [nfs] [<ffffffff810d23c8>] ? alloc_pages_current+0xc7/0xe4 [<ffffffff810a68b5>] ? __page_cache_alloc+0x84/0x91 [<ffffffff810af912>] ? __do_page_cache_readahead+0xa6/0x2e0 [<ffffffff810afaa3>] __do_page_cache_readahead+0x237/0x2e0 [<ffffffff810af912>] ? __do_page_cache_readahead+0xa6/0x2e0 [<ffffffff810afe3e>] ra_submit+0x1c/0x20 [<ffffffff810b019b>] ondemand_readahead+0x359/0x382 [<ffffffff810b0279>] page_cache_sync_readahead+0x38/0x3a [<ffffffff810a77b5>] generic_file_aio_read+0x26b/0x637 [<ffffffffa00f1852>] ? nfs_mark_delegation_referenced+0xb/0xb [nfsv4] [<ffffffffa009cc85>] nfs_file_read+0xaa/0xcf [nfs] [<ffffffff810db5b3>] do_sync_read+0x91/0xd1 [<ffffffff810dbb8b>] vfs_read+0x9b/0x144 [<ffffffff810dbc78>] sys_read+0x44/0x75 [<ffffffff81422892>] system_call_fastpath+0x16/0x1b Signed-off-by: David Howells <[email protected]>
2012-12-20FS-Cache: Mark cancellation of in-progress operationDavid Howells4-11/+12
Mark as cancelled an operation that is in progress rather than pending at the time it is cancelled, and call fscache_complete_op() to cancel an operation so that blocked ops can be started. Signed-off-by: David Howells <[email protected]>
Powered by cgit, Gruvboxed by Blaster4385.