UBUNTU: Start new release

Ignore: yes
Signed-off-by: Brad Figg <brad.figg@canonical.com>
exec: use -ELOOP for max recursion depth

CVE-2012-4530

BugLink: http://bugs.launchpad.net/bugs/1068888

To avoid an explosion of request_module calls on a chain of abusive
scripts, fail maximum recursion with -ELOOP instead of -ENOEXEC. As soon
as maximum recursion depth is hit, the error will fail all the way back
up the chain, aborting immediately.

This also has the side-effect of stopping the user's shell from attempting
to reexecute the top-level file as a shell script. As seen in the
dash source:

        if (cmd != path_bshell && errno == ENOEXEC) {
                *argv-- = cmd;
                *argv = cmd = path_bshell;
                goto repeat;
        }

The above logic was designed for running scripts automatically that lacked
the "#!" header, not to re-try failed recursion. On a legitimate -ENOEXEC,
things continue to behave as the shell expects.

Additionally, when tracking recursion, the binfmt handlers should not be
involved. The recursion being tracked is the depth of calls through
search_binary_handler(), so that function should be exclusively responsible
for tracking the depth.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: halfdog <me@halfdog.net>
Cc: P J P <ppandit@redhat.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(backported from commit d740269867021faf4ce38a449353d2b986c34a67)
Conflicts:
	fs/binfmt_misc.c
	fs/exec.c
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Acked-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Acked-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: SAUCE: exec: do not leave bprm->interp on stack

CVE-2012-4530

BugLink: http://bugs.launchpad.net/bugs/1068888

If a series of scripts are executed, each triggering module loading via
unprintable bytes in the script header, kernel stack contents can leak
into the command line.

Normally execution of binfmt_script and binfmt_misc happens recursively.
However, when modules are enabled, and unprintable bytes exist in the
bprm->buf, execution will restart after attempting to load matching binfmt
modules.  Unfortunately, the logic in binfmt_script and binfmt_misc does
not expect to get restarted.  They leave bprm->interp pointing to their
local stack.  This means on restart bprm->interp is left pointing into
unused stack memory which can then be copied into the userspace argv
areas.

After additional study, it seems that both recursion and restart remains
the desirable way to handle exec with scripts, misc, and modules.  As
such, we need to protect the changes to interp.

This changes the logic to require allocation for any changes to the
bprm->interp.  To avoid adding a new kmalloc to every exec, the default
value is left as-is.  Only when passing through binfmt_script or
binfmt_misc does an allocation take place.

For a proof of concept, see DoTest.sh from:
http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: halfdog <me@halfdog.net>
Cc: P J P <ppandit@redhat.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Acked-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Acked-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Andy Whitcroft <apw@canonical.com>
UBUNTU: Ubuntu-2.6.32-45.102

Signed-off-by: Brad Figg <brad.figg@canonical.com>
add console_use_vt Patch-mainline: no $subject says all
kexec: Move asm segment handling code to the assembly file (i386) Patch-mainline: obsolete This patch moves the idt, gdt, and segment handling code from machine_kexec.c to relocate_kernel.S. The main reason behind this move is to avoid code duplication in the Xen hypervisor. With this patch all code required to kexec is put on the control page.

On top of that this patch also counts as a cleanup - I think it is much
nicer to write assembly directly in assembly files than wrap inline assembly
in C functions for no apparent reason.

Signed-off-by: Magnus Damm <magnus@valinux.co.jp>
Acked-by: jbeulich@novell.com

 Applies to 2.6.19-rc1.
 jb: fixed up register usage (paralleling what's needed for 2.6.30 on x86-64)
kexec: Move asm segment handling code to the assembly file (x86_64) Patch-mainline: obsolete This patch moves the idt, gdt, and segment handling code from machine_kexec.c to relocate_kernel.S. The main reason behind this move is to avoid code duplication in the Xen hypervisor. With this patch all code required to kexec is put on the control page.

On top of that this patch also counts as a cleanup - I think it is much
nicer to write assembly directly in assembly files than wrap inline assembly
in C functions for no apparent reason.

Signed-off-by: Magnus Damm <magnus@valinux.co.jp>
Acked-by: jbeulich@novell.com

 Applies to 2.6.19-rc1.
 jb: fixed up register usage for 2.6.30 (bnc#545206)
Subject: Allow to bring up network interface w/o ipv6 autoconf References: 161888 When bringing up a xen bridge device, it will always be configured to use a MAC address of ff:ff:ff:ff:ff:fe. This greatly confuses IPv6 DAD, which starts logging lots and lots of useless messages to syslog.

We really want to disable IPv6 on these interfaces, and there doesn't
seem to be a reliable way to do this without bringing the interface
up first (and triggering IPv6 autoconf).

This patch makes autoconf (DAD and router discovery) depend on the
interface's ability to do multicast. Turning off multicast for an
interface before bringing it up will suppress autoconfiguration.

 net/ipv6/addrconf.c |    2 ++
 1 files changed, 2 insertions(+)
xen/dom0: Reserve devices for guest use Patch-mainline: obsolete Acked-by: jbeulich@novell.com
linux/pci: reserve io/memory space for bridge Patch-mainline: obsolete reserve io/memory space for bridge which will be used later by PCI hotplug.

Signed-off-by: Isaku Yamahata <yamahata@valinux.co.jp>
Acked-by: jbeulich@novell.com
# replaces http://xenbits.xensource.com/linux-2.6.18-xen.hg c/s 421: # HG changeset patch # User Keir Fraser <keir.fraser@citrix.com> # Date 1203330569 0 # Node ID e4dd072db2595c420bb21d9e835416f4fd543526 # Parent fc90e9b2c12b316b5460ece28f013e6de881af1a Subject: Solarflare: Resource driver. References: FATE#303479 Acked-by: jbeulich@novell.com
Transcendent memory ("tmem") for Linux Patch-mainline: obsolete Tmem, when called from a tmem-capable (paravirtualized) guest, makes use of otherwise unutilized ("fallow") memory to create and manage pools of pages that can be accessed from the guest either as "ephemeral" pages or as "persistent" pages. In either case, the pages are not directly addressible by the guest, only copied to and fro via the tmem interface. Ephemeral pages are a nice place for a guest to put recently evicted clean pages that it might need again; these pages can be reclaimed synchronously by Xen for other guests or other uses. Persistent pages are a nice place for a guest to put "swap" pages to avoid sending them to disk. These pages retain data as long as the guest lives, but count against the guest memory allocation.

This patch contains the Linux paravirtualization changes to
complement the tmem Xen patch (xen-unstable c/s 19646). It
implements "precache" (ext3 only as of now), "preswap",
and limited "shared precache" (ocfs2 only as of now) support.
CONFIG options are required to turn on
the support (but in this patch they default to "y"). If
the underlying Xen does not have tmem support or has it
turned off, this is sensed early to avoid nearly all
hypercalls.

Lots of useful prose about tmem can be found at
http://oss.oracle.com/projects/tmem

Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Acked-by: jbeulich@novell.com
xen3 xen-arch Patch-mainline: obsolete Acked-by: jbeulich@novell.com List of files having Xen derivates (perhaps created during the merging of newer kernel versions), for xen-port-patches.py to pick up (i.e. this must be retained here until the XenSource tree has these in the right places): +++ linux/arch/x86/kernel/acpi/sleep-xen.c +++ linux/arch/x86/kernel/apic/apic-xen.c +++ linux/arch/x86/kernel/apic/io_apic-xen.c +++ linux/arch/x86/kernel/apic/ipi-xen.c +++ linux/arch/x86/kernel/apic/probe_32-xen.c +++ linux/arch/x86/kernel/apic-xen.c +++ linux/arch/x86/kernel/cpu/common_64-xen.c +++ linux/arch/x86/kernel/e820-xen.c +++ linux/arch/x86/kernel/head-xen.c +++ linux/arch/x86/kernel/head32-xen.c +++ linux/arch/x86/kernel/ioport-xen.c +++ linux/arch/x86/kernel/io_apic-xen.c +++ linux/arch/x86/kernel/ipi-xen.c +++ linux/arch/x86/kernel/irq-xen.c +++ linux/arch/x86/kernel/ldt-xen.c +++ linux/arch/x86/kernel/microcode_core-xen.c +++ linux/arch/x86/kernel/mpparse-xen.c +++ linux/arch/x86/kernel/pci-nommu-xen.c +++ linux/arch/x86/kernel/process-xen.c +++ linux/arch/x86/kernel/setup-xen.c +++ linux/arch/x86/kernel/smp-xen.c +++ linux/arch/x86/kernel/traps-xen.c +++ linux/arch/x86/kernel/x86_init-xen.c +++ linux/arch/x86/mm/fault-xen.c +++ linux/arch/x86/mm/init-xen.c +++ linux/arch/x86/mm/iomap_32-xen.c +++ linux/arch/x86/mm/ioremap-xen.c +++ linux/arch/x86/mm/pageattr-xen.c +++ linux/arch/x86/mm/pat-xen.c +++ linux/arch/x86/mm/pgtable-xen.c +++ linux/arch/x86/vdso/vdso32-setup-xen.c +++ linux/drivers/char/mem-xen.c +++ linux/arch/x86/include/mach-xen/asm/desc.h +++ linux/arch/x86/include/mach-xen/asm/dma-mapping.h +++ linux/arch/x86/include/mach-xen/asm/fixmap.h +++ linux/arch/x86/include/mach-xen/asm/io.h +++ linux/arch/x86/include/mach-xen/asm/ipi.h +++ linux/arch/x86/include/mach-xen/asm/irq_vectors.h +++ linux/arch/x86/include/mach-xen/asm/irqflags.h +++ linux/arch/x86/include/mach-xen/asm/mmu_context.h +++ linux/arch/x86/include/mach-xen/asm/pci.h +++ linux/arch/x86/include/mach-xen/asm/pgalloc.h +++ linux/arch/x86/include/mach-xen/asm/pgtable.h +++ linux/arch/x86/include/mach-xen/asm/pgtable-3level_types.h +++ linux/arch/x86/include/mach-xen/asm/pgtable_64_types.h +++ linux/arch/x86/include/mach-xen/asm/pgtable_types.h +++ linux/arch/x86/include/mach-xen/asm/processor.h +++ linux/arch/x86/include/mach-xen/asm/smp.h +++ linux/arch/x86/include/mach-xen/asm/spinlock.h +++ linux/arch/x86/include/mach-xen/asm/swiotlb.h +++ linux/arch/x86/include/mach-xen/asm/system.h +++ linux/arch/x86/include/mach-xen/asm/tlbflush.h +++ linux/arch/x86/include/mach-xen/asm/xor.h

List of files folded into their native counterparts (and hence removed
from this patch for xen-port-patches.py to not needlessly pick them up;
for reference, prefixed with the version the removal occured):
2.6.18/arch/x86/include/mach-xen/asm/pgtable-2level.h
2.6.18/arch/x86/include/mach-xen/asm/pgtable-2level-defs.h
2.6.19/arch/x86/include/mach-xen/asm/ptrace.h
2.6.23/arch/x86/include/mach-xen/asm/ptrace_64.h
2.6.23/arch/x86/kernel/vsyscall-note_32-xen.S
2.6.24/arch/x86/include/mach-xen/asm/arch_hooks_64.h
2.6.24/arch/x86/include/mach-xen/asm/bootsetup_64.h
2.6.24/arch/x86/include/mach-xen/asm/mmu_32.h
2.6.24/arch/x86/include/mach-xen/asm/mmu_64.h
2.6.24/arch/x86/include/mach-xen/asm/nmi_64.h
2.6.24/arch/x86/include/mach-xen/asm/setup.h
2.6.24/arch/x86/include/mach-xen/asm/time_64.h (added in 2.6.20)
2.6.24/arch/x86/include/mach-xen/mach_timer.h
2.6.24/arch/x86/kernel/early_printk_32-xen.c
2.6.25/arch/x86/ia32/syscall32-xen.c
2.6.25/arch/x86/ia32/syscall32_syscall-xen.S
2.6.25/arch/x86/ia32/vsyscall-int80.S
2.6.25/arch/x86/include/mach-xen/asm/msr.h
2.6.25/arch/x86/include/mach-xen/asm/page_32.h
2.6.25/arch/x86/include/mach-xen/asm/spinlock_32.h
2.6.25/arch/x86/include/mach-xen/asm/timer.h (added in 2.6.24)
2.6.25/arch/x86/include/mach-xen/asm/timer_64.h
2.6.25/arch/x86/include/mach-xen/mach_time.h
2.6.25/arch/x86/kernel/acpi/boot-xen.c
2.6.26/arch/x86/include/mach-xen/asm/dma-mapping_32.h
2.6.26/arch/x86/include/mach-xen/asm/dma-mapping_64.h
2.6.26/arch/x86/include/mach-xen/asm/nmi.h (added in 2.6.24)
2.6.26/arch/x86/include/mach-xen/asm/scatterlist.h (added in 2.6.24)
2.6.26/arch/x86/include/mach-xen/asm/scatterlist_32.h
2.6.26/arch/x86/include/mach-xen/asm/swiotlb_32.h
2.6.26/arch/x86/kernel/pci-dma_32-xen.c
2.6.26/arch/x86/kernel/pci-swiotlb_64-xen.c
2.6.26/include/xen/xencomm.h
2.6.27/arch/x86/include/mach-xen/asm/e820.h (added in 2.6.24)
2.6.27/arch/x86/include/mach-xen/asm/e820_64.h
2.6.27/arch/x86/include/mach-xen/asm/hw_irq.h (added in 2.6.24)
2.6.27/arch/x86/include/mach-xen/asm/hw_irq_32.h
2.6.27/arch/x86/include/mach-xen/asm/hw_irq_64.h
2.6.27/arch/x86/include/mach-xen/asm/io_32.h
2.6.27/arch/x86/include/mach-xen/asm/io_64.h
2.6.27/arch/x86/include/mach-xen/asm/irq.h (added in 2.6.24)
2.6.27/arch/x86/include/mach-xen/asm/irq_64.h
2.6.27/arch/x86/kernel/e820_32-xen.c
2.6.28/arch/x86/include/mach-xen/asm/pci_64.h
2.6.28/arch/x86/include/mach-xen/asm/segment.h (added in 2.6.24)
2.6.28/arch/x86/include/mach-xen/asm/segment_32.h
2.6.30/arch/x86/include/mach-xen/asm/page.h (added in 2.6.24)
2.6.30/arch/x86/include/mach-xen/asm/page_64.h
2.6.30/arch/x86/include/mach-xen/asm/pci_32.h
2.6.30/arch/x86/kernel/apic/apic_xen_64.c
2.6.30/arch/x86/kernel/apic/probe_64-xen.c
2.6.30/arch/x86/kernel/setup_percpu-xen.c (added in 2.6.27)
2.6.31/arch/x86/kernel/init_task-xen.c
2.6.32/arch/x86/include/mach-xen/asm/setup_arch.h
xen3 xen-drivers Patch-mainline: obsolete Acked-by: jbeulich@novell.com
xen3 include-xen-interface Patch-mainline: obsolete Acked-by: jbeulich@novell.com
xen3 xen-kconfig Patch-mainline: obsolete Acked-by: jbeulich@novell.com
xen3 common Patch-mainline: obsolete Acked-by: jbeulich@novell.com List of files that don't require modification anymore (and hence removed from this patch), for reference and in case upstream wants to take the forward porting patches: 2.6.22/include/linux/sched.h 2.6.22/kernel/softlockup.c 2.6.22/kernel/timer.c 2.6.25/mm/highmem.c 2.6.30/include/linux/pci_regs.h
xen3 arch-x86 Patch-mainline: obsolete Acked-by: jbeulich@novell.com List of files that don't require modification anymore (and hence removed from this patch), for reference and in case upstream wants to take the forward porting patches: 2.6.26/arch/x86/kernel/crash.c 2.6.30/arch/x86/kernel/acpi/boot.c
xen3 arch-i386 Patch-mainline: obsolete Acked-by: jbeulich@novell.com
xen3 arch-x86_64 Patch-mainline: obsolete Acked-by: jbeulich@novell.com