signal: always clear sa_restorer on execve

When the new signal handlers are set up, the location of sa_restorer is
not cleared, leaking a parent process's address space location to
children.  This allows for a potential bypass of the parent's ASLR by
examining the sa_restorer value returned when calling sigaction().

Based on what should be considered "secret" about addresses, it only
matters across the exec not the fork (since the VMAs haven't changed
until the exec).  But since exec sets SIG_DFL and keeps sa_restorer,
this is where it should be fixed.

Given the few uses of sa_restorer, a "set" function was not written
since this would be the only use.  Instead, we use
__ARCH_HAS_SA_RESTORER, as already done in other places.

Example of the leak before applying this patch:

  $ cat /proc/$$/maps
  ...
  7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
  ...
  $ ./leak
  ...
  7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
  ...
  1 0 (nil) 0x7fb9f30b94a0
  2 4000000 (nil) 0x7f278bcaa4a0
  3 4000000 (nil) 0x7f278bcaa4a0
  4 0 (nil) 0x7fb9f30b94a0
  ...

[akpm@linux-foundation.org: use SA_RESTORER for backportability]
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Emese Revfy <re.emese@gmail.com>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Julien Tinnes <jln@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: I7ae396ee90c2339c86f7b773d15f5571f8fd54c5
Signed-off-by: Goberu Gopal <ggober@codeaurora.org>
Merge "signal: always clear sa_restorer on execve"
Revert "hrtimer: Consider preemption when migrating hrtimer cpu_bases"

This reverts commit 4296a2ff5e9ce15fd35066339d998c45252da622

Change-Id: I79fa7e0e3fe2d622f1b1276b3646ab4120b6d5f4
Signed-off-by: Tirupathi Reddy <tirupath@codeaurora.org>
Revert "hrtimer: Prevent enqueue of hrtimer on dead CPU"

This reverts commit 33f6cd54e696a2c101aaea2e2c23734c6f229b7f

Change-Id: I6e94993b80a19926c6b07a0b7b15e920f5b7dce3
Signed-off-by: Tirupathi Reddy <tirupath@codeaurora.org>
msm_serial_hs: Disable UART RxStale before Force RxStale in set_termios

There is possible race for handling normal RxStale event and Force
Rxstale event with UART Core, when Force RxStale is issued from
set_termios(). Hence on baud rate change request disable RxStale event
mechanism, and invoke Force RxStale. With RxStale event mechanism
disabled, Force RxStale still generates interrupt.
Fix possible race condition if before completion of previous UART RX CMD
flush, set_termios() request is received. With this case it is quite
possible that rx_tlet() queues one UART RX CMD with ADM driver and also
set_termios() queues one more UART RX CMD which would results with
queueing same UART RX CMD twice with ADM driver. With this device would
crash as the ADM driver will not be able to de-reference the second UART
RX CMD work. Hence add check in set_termios with rx.flush value as
FLUSH_DATA_READY which confirms that flush is initiated but it is not
completed and wait for rx.flush to become FLUSH_NONE which would happen
only once flush is completed and new UART RX CMD is being queued with ADM
driver.
Reduce waiting time for discard flush completion as it is already waited
for queued UART Rx CMD to be programmed with ADM hardware. Hence change
wait time out from 300 jiffies to 50 mseconds.
Add an API to get important UART core registers values which can be called
from error condition. Use the same when discard flush timeout happens with
set_termios(), when rx.dma_in_flight is not set with set_termios() and when
multiple UART RX CMD queueing condition is seen in msm_hs_start_rx_locked()
API.

CRs-Fixed: 486260
Change-Id: If3e7ee1db8d884a8d8dfa994aa87b4aafe7723fa
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
msm_serial_hs: Improve UART Shutdown path

For uart port close operation, serial core calls msm_hs_stop_rx_locked()
which sends discard flush request to ADM driver after changing rx.flush
state machine from FLUSH_NONE to FLUSH_STOP value. Next serial core
calls msm_hs_shutdown()and it waits for discard flush completion with
rx.flush state machine to be set as FLUSH_SHUTDOWN to complete uart
port close operation. With this approach, transfer termination is not
known by UART Core which may still allow UART core to make CRCI request
with ADM Core if new data is being received from remote uart. Hence
invoke Force RxStale from msm_hs_stop_rx_locked() which informs UART
core to terminate current Rx transfer and do not make any new CRCI
request with ADM core for any new incoming data. On receiving RxStale
interrupt, it sends discard flush request to ADM driver to terminate
transfer with ADM hardware.
This new programming sequence is required to get both UART and ADM
hardwares in-sync for termination of transfer.

CRs-Fixed: 475230
Change-Id: I802a456294d4fd2fa51a5f4e918a4f4f22bc5ee3
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
msm_serial_hs: Fixing issue during UART shutdown

During UART port close in msm_hs_shutdown(), flag is_shutdown is
set as true and then UART interrupt is disabled and UART irq line
is freed. This is causing corner case in which even if uart shutdown
is in progress, UART interrupt can come as the UART interrupt is not
disabled and UART irq line not freed at this point. As flag
is_shutdown is set as true in msm_hs_shutdown() and then if UART
interrupt comes, it is hitting BUG_ON in UART Interrupt handler
msm_hs_isr(). To fix this issue, disable the UART irq and free
the UART irq line at the beginning of the msm_hs_shutdown() and
then set the flag is_shutdown.

In msm_hs_shutdown, disabling UART Interrupt and setting flag
is_shutdown is done with uart spinlock acquired. There is a
possibility that on other core, msm_hs_isr() might need to wait
for the same uart spinlock and later when msm_hs_isr() is executed
BUG_ON is hit. As by this time all UART Interrupt is disabled,
hence removing the BUG_ON and instead keep prints to notify the
same.

CRs-Fixed: 487945
Change-Id: I21fb032139fd59793169f97a90c4644bae562159
Signed-off-by: Saket Saurabh <ssaurabh@codeaurora.org>
Merge "msm_serial_hs: Disable UART RxStale before Force RxStale in set_termios"
Merge "msm_serial_hs: Improve UART Shutdown path"
Merge "msm_serial_hs: Fixing issue during UART shutdown"
timer: Don't reinitialize the cpu base lock during CPU_UP_PREPARE

An inactive timer's base can refer to a offline cpu's base.

In the current code, cpu_base's lock is blindly reinitialized
each time a CPU is brought up. If a CPU is brought online
during the period that another thread is trying to modify an
inactive timer on that CPU with holding its timer base lock,
then the lock will be reinitialized under its feet. This leads
to following SPIN_BUG().

<0> BUG: spinlock already unlocked on CPU#3, kworker/u:3/1466
<0> lock: 0xe3ebe000, .magic: dead4ead, .owner: kworker/u:3/1466, .owner_cpu: 1
<4> [<c0013dc4>] (unwind_backtrace+0x0/0x11c) from [<c026e794>] (do_raw_spin_unlock+0x40/0xcc)
<4> [<c026e794>] (do_raw_spin_unlock+0x40/0xcc) from [<c076c160>] (_raw_spin_unlock+0x8/0x30)
<4> [<c076c160>] (_raw_spin_unlock+0x8/0x30) from [<c009b858>] (mod_timer+0x294/0x310)
<4> [<c009b858>] (mod_timer+0x294/0x310) from [<c00a5e04>] (queue_delayed_work_on+0x104/0x120)
<4> [<c00a5e04>] (queue_delayed_work_on+0x104/0x120) from [<c04eae00>] (sdhci_msm_bus_voting+0x88/0x9c)
<4> [<c04eae00>] (sdhci_msm_bus_voting+0x88/0x9c) from [<c04d8780>] (sdhci_disable+0x40/0x48)
<4> [<c04d8780>] (sdhci_disable+0x40/0x48) from [<c04bf300>] (mmc_release_host+0x4c/0xb0)
<4> [<c04bf300>] (mmc_release_host+0x4c/0xb0) from [<c04c7aac>] (mmc_sd_detect+0x90/0xfc)
<4> [<c04c7aac>] (mmc_sd_detect+0x90/0xfc) from [<c04c2504>] (mmc_rescan+0x7c/0x2c4)
<4> [<c04c2504>] (mmc_rescan+0x7c/0x2c4) from [<c00a6a7c>] (process_one_work+0x27c/0x484)
<4> [<c00a6a7c>] (process_one_work+0x27c/0x484) from [<c00a6e94>] (worker_thread+0x210/0x3b0)
<4> [<c00a6e94>] (worker_thread+0x210/0x3b0) from [<c00aad9c>] (kthread+0x80/0x8c)
<4> [<c00aad9c>] (kthread+0x80/0x8c) from [<c000ea80>] (kernel_thread_exit+0x0/0x8)

As an example, this particular crash occurred when CPU #3 is executing
mod_timer() on an inactive timer whose base is refered to offlined CPU #2.
The code locked the timer_base corresponding to CPU #2. Before it could
proceed, CPU #2 came online and reinitialized the spinlock corresponding
to its base. Thus now CPU #3 held a lock which was reinitialized. When
CPU #3 finally ended up unlocking the old cpu_base corresponding to CPU #2,
we hit the above SPIN_BUG().

CPU #0			CPU #3				       CPU #2
------			-------				       -------
.....			 ......				      <Offline>
			mod_timer()
			 lock_timer_base
			   spin_lock_irqsave(&base->lock)

cpu_up(2)		 .....				        ......
								init_timers_cpu()
....			 .....				    	  spin_lock_init(&base->lock)
.....		 	 spin_unlock_irqrestore(&base->lock)    ......
			   <spin_bug>

Allocation of per_cpu timer vector bases is done only once under
"tvec_base_done[]" check. In the current code, spinlock_initialization
of base->lock isn't under this check. When a CPU is up each time the base
lock is reinitialized. Move base spinlock initialization under the check.

CRs-Fixed: 471127
Change-Id: Ieaf20fcceab69053211ed8592a8f128bd8558dab
Signed-off-by: Tirupathi Reddy <tirupath@codeaurora.org>
Link: http://lkml.kernel.org/r/1368520142-4136-1-git-send-email-tirupath@codeaurora.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
msm8x25: Send FIQ to all possible cpus instead of online cpus

cpu_online_mask gets modified very late when core brought up,
so send SGI to all the cores in cpu_possible_mask

Change-Id: I2f3bb26506d63aeb6a770b185d019dec5c8ffcac
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
Merge "Revert "hrtimer: Consider preemption when migrating hrtimer cpu_bases""
Merge "Revert "hrtimer: Prevent enqueue of hrtimer on dead CPU""
Merge "timer: Don't reinitialize the cpu base lock during CPU_UP_PREPARE"
Merge "msm8x25: Send FIQ to all possible cpus instead of online cpus"